diff --git a/client-sdks/platform/openapi.json b/client-sdks/platform/openapi.json
index f1af52ac69..7b077c7a53 100644
--- a/client-sdks/platform/openapi.json
+++ b/client-sdks/platform/openapi.json
@@ -1 +1 @@
-{"openapi":"3.0.0","info":{"title":"Alien API","version":"1.0.0","contact":{"name":"Alien Team","url":"https://alien.dev"}},"servers":[{"url":"https://api.alien.dev","description":"Alien API - Production"}],"security":[{"apiKey":[]}],"components":{"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","bearerFormat":"API key","description":"API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys"}},"schemas":{"WorkspaceInvitationPreview":{"type":"object","properties":{"kind":{"type":"string","enum":["email","link"]},"workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name","logoUrl"]},"inviter":{"type":"object","nullable":true,"properties":{"name":{"type":"string"},"image":{"type":"string","nullable":true,"format":"uri"}},"required":["name","image"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"state":{"type":"string","enum":["active","accepted","expired","revoked"]},"emailHint":{"type":"string","nullable":true}},"required":["kind","workspace","inviter","role","expiresAt","state","emailHint"],"additionalProperties":false},"WorkspaceRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"Role for workspace-scoped service accounts","example":"workspace.member"},"APIError":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"requestId":{"type":"string","description":"Request ID echoed in the x-request-id response header and server logs."}},"required":["code","message","internal"]},"Membership":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"role":{"type":"string"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","logoUrl","role","createdAt"],"additionalProperties":false},"UserProfile":{"type":"object","properties":{"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","description":"User's email address"},"name":{"type":"string","description":"User's display name"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"},"githubUsername":{"type":"string","nullable":true,"description":"Linked GitHub username"},"cliConnected":{"type":"boolean","description":"Whether this user has ever authenticated a request from the Alien CLI. Latched on first CLI request, never cleared."},"company":{"type":"string","nullable":true,"description":"Company name collected during profile setup."},"acquisitionSource":{"type":"string","nullable":true,"enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other",null],"description":"How the user heard about Alien."},"acquisitionSourceDetail":{"type":"string","nullable":true,"description":"Additional acquisition source detail when the source is other."},"useCases":{"type":"string","nullable":true,"description":"What the user is hoping to use Alien for."},"profileSetupCompletedAt":{"type":"string","format":"date-time","nullable":true,"description":"When the user completed the required profile setup dialog."},"profileSetupVersion":{"type":"integer","nullable":true,"description":"Version of the required profile setup dialog the user completed."}},"required":["id","email","name","image","githubUsername","cliConnected","company","acquisitionSource","acquisitionSourceDetail","useCases","profileSetupCompletedAt","profileSetupVersion"],"additionalProperties":false},"UserProfileSetupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"},"company":{"type":"string","minLength":1,"maxLength":120,"description":"Company name"},"acquisitionSource":{"type":"string","enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other"],"description":"How the user heard about Alien"},"acquisitionSourceDetail":{"type":"string","minLength":1,"maxLength":200,"description":"Required when acquisitionSource is other"},"useCases":{"type":"string","maxLength":2000,"description":"What the user is hoping to use Alien for"}},"required":["name","company","acquisitionSource"],"additionalProperties":false},"GitNamespace":{"type":"object","properties":{"id":{"type":"number","nullable":true},"name":{"type":"string"},"slug":{"type":"string"},"installationId":{"type":"number","nullable":true},"type":{"type":"string","enum":["team","user"]},"provider":{"type":"string","enum":["github"]},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","slug","installationId","type","provider","createdAt"],"additionalProperties":false},"GitRepository":{"type":"object","properties":{"name":{"type":"string"},"private":{"type":"boolean"},"defaultBranch":{"type":"string"},"pushedAt":{"type":"string","format":"date-time"}},"required":["name","private","defaultBranch"],"additionalProperties":false},"AcceptWorkspaceInvitationResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["joined","already-member"]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"workspaceName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["outcome","workspaceId","workspaceName","role"],"additionalProperties":false},"Subject":{"oneOf":[{"$ref":"#/components/schemas/UserSubject"},{"$ref":"#/components/schemas/ServiceAccountSubject"}],"discriminator":{"propertyName":"kind","mapping":{"user":"#/components/schemas/UserSubject","serviceAccount":"#/components/schemas/ServiceAccountSubject"}},"description":"Authenticated principal that can be either a user (with workspace-scoped permissions) or a service account (with configurable scope and role)"},"UserSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["user"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","format":"email","description":"User's email address"},"workspaceId":{"type":"string","description":"ID of the workspace the user is authenticated within"},"workspaceName":{"type":"string","description":"Name of the workspace the user is authenticated within"},"role":{"$ref":"#/components/schemas/UserRole"}},"required":["kind","id","email","workspaceId","role"],"description":"Authenticated user subject with workspace-scoped permissions"},"UserRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"User's role within the workspace","example":"workspace.member"},"ServiceAccountSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["serviceAccount"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique service account identifier (API key ID)"},"workspaceId":{"type":"string","description":"ID of the workspace the service account belongs to"},"workspaceName":{"type":"string","description":"Name of the workspace the service account belongs to"},"scope":{"$ref":"#/components/schemas/SubjectScope"},"role":{"$ref":"#/components/schemas/Role"}},"required":["kind","id","workspaceId","scope","role"],"description":"Authenticated service account subject with scoped permissions (workspace, project, or deployment level)"},"SubjectScope":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["workspace"],"description":"Workspace-scoped access"}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["project"],"description":"Project-scoped access"},"projectId":{"type":"string","description":"ID of the specific project this scope applies to"}},"required":["type","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment"],"description":"Deployment-scoped access"},"deploymentId":{"type":"string","description":"ID of the specific deployment this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"}},"required":["type","deploymentId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"],"description":"Deployment group-scoped access"},"deploymentGroupId":{"type":"string","description":"ID of the specific deployment group this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"}},"required":["type","deploymentGroupId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["manager"],"description":"Manager-scoped access"},"managerId":{"type":"string","description":"ID of the specific manager this scope applies to"}},"required":["type","managerId"]}],"description":"Authorization scope defining what resources this service account can access"},"Role":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"$ref":"#/components/schemas/ProjectRole"},{"$ref":"#/components/schemas/DeploymentRole"},{"$ref":"#/components/schemas/DeploymentGroupRole"},{"$ref":"#/components/schemas/ManagerRole"}],"description":"Role defining what actions this service account can perform within its scope","example":"workspace.member"},"ProjectRole":{"type":"string","enum":["project.viewer","project.developer","project.encryption","project.ai-gateway","project.sandbox-gateway","project.remote-bindings"],"description":"Role for project-scoped service accounts","example":"project.developer"},"DeploymentRole":{"type":"string","enum":["deployment.viewer","deployment.manager","deployment.dynamic-container-manager","deployment.telemetry-writer"],"description":"Role for deployment-scoped service accounts","example":"deployment.manager"},"DeploymentGroupRole":{"type":"string","enum":["deployment-group.deployer"],"description":"Role for deployment group-scoped service accounts","example":"deployment-group.deployer"},"ManagerRole":{"type":"string","enum":["manager.runtime"],"description":"Role for manager-scoped service accounts","example":"manager.runtime"},"ProjectIDOrNamePathParam":{"type":"string","maxLength":100,"description":"Project ID or name."},"Workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name.","example":"my-workspace"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","createdAt"],"additionalProperties":false},"WorkspaceMember":{"type":"object","properties":{"userId":{"type":"string"},"email":{"type":"string"},"name":{"type":"string"},"image":{"type":"string","nullable":true},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"joinedAt":{"type":"string","format":"date-time"}},"required":["userId","email","name","image","role","joinedAt"],"additionalProperties":false},"AgentSettings":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"enabled":{"type":"boolean","description":"Workspace on/off switch for the ai-agent. When `false`, incoming triggers (release/deployment monitoring and Slack-invoked sessions) are rejected before any session runs. Defaults to `true`."},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","enabled","createdAt","updatedAt"],"additionalProperties":false},"UpdateWorkspaceSettingsRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Turn the ai-agent on (`true`) or off (`false`) for this workspace."}}},"WorkspaceInvitation":{"type":"object","properties":{"id":{"type":"string","pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"},"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"status":{"type":"string","enum":["pending","accepted","revoked","expired"]},"deliveryStatus":{"type":"string","enum":["pending","sent","failed"]},"expiresAt":{"type":"string","format":"date-time"},"lastSentAt":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","email","role","status","deliveryStatus","expiresAt","lastSentAt","createdAt","inviteUrl"],"additionalProperties":false},"WorkspaceInviteLink":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"wil_[0-9a-zA-Z]{40}$","description":"Unique identifier for the workspace invite link.","example":"wil_RgcthDSZ37rmFLekuItpFS7btjXoYwou1gE4"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"useCount":{"type":"integer","minimum":0},"lastUsedAt":{"type":"string","format":"date-time","nullable":true},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","role","expiresAt","createdAt","useCount","lastUsedAt","inviteUrl"],"additionalProperties":false},"ProjectListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"deploymentCount":{"type":"number"},"latestRelease":{"$ref":"#/components/schemas/ProjectReleaseInfo"}}}]},"DeploymentPortalAppearancePreset":{"type":"string","enum":["clean","technical","enterprise","playful","minimal"],"default":"clean","description":"Curated visual style for the deployment portal."},"DeploymentPortalAccentColor":{"type":"string","enum":["blue","purple","green","orange","pink","slate"],"default":"blue","description":"Accent color used for highlights and primary actions."},"DeploymentPortalDensity":{"type":"string","enum":["comfortable","compact"],"default":"comfortable","description":"Layout density for portal content."},"ProjectReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","gitMetadata","createdAt"]},"GitMetadata":{"type":"object","nullable":true,"properties":{"commitSha":{"type":"string","nullable":true,"pattern":"^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$","description":"The hash of the commit","example":"dc36199b2234c6586ebe05ec94078a895c707e29"},"commitMessage":{"type":"string","nullable":true,"maxLength":1024,"description":"The commit message","example":"add method to measure Interaction to Next Paint (INP) (#36490)"},"commitRef":{"type":"string","nullable":true,"maxLength":256,"description":"The branch or tag on which the commit was made","example":"main"},"commitDate":{"type":"string","nullable":true,"format":"date-time","description":"The date and time when the commit was created","example":"2026-03-16T12:00:00Z"},"dirty":{"type":"boolean","nullable":true,"description":"Whether or not there have been modifications to the working tree since the latest commit","example":true},"remoteUrl":{"type":"string","nullable":true,"maxLength":2048,"description":"The git repository's remote origin url","example":"https://github.com/alienplatform/alien"},"commitAuthorName":{"type":"string","nullable":true,"maxLength":256,"description":"The name of the author of the commit (from git config)","example":"John Doe"},"commitAuthorEmail":{"type":"string","nullable":true,"maxLength":256,"description":"The author identity recorded by Git. This is not guaranteed to be an RFC-valid email address.","example":"john@example.com"},"commitAuthorLogin":{"type":"string","nullable":true,"maxLength":256,"description":"The provider username of the commit author (e.g., GitHub login), resolved server-side from the commit email","example":"johndoe"},"commitAuthorAvatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"The avatar URL of the commit author, resolved server-side from the provider login","example":"https://github.com/johndoe.png"},"provider":{"$ref":"#/components/schemas/GitProvider"}}},"GitProvider":{"oneOf":[{"$ref":"#/components/schemas/GitHubProvider"},{"$ref":"#/components/schemas/GitLabProvider"},{"nullable":true}],"description":"Provider-specific repository information, resolved server-side from remoteUrl"},"GitHubProvider":{"type":"object","properties":{"type":{"type":"string","enum":["github"]},"org":{"type":"string","maxLength":256,"description":"Repository owner (user or organization)"},"repo":{"type":"string","maxLength":256,"description":"Repository name"}},"required":["type","org","repo"]},"GitLabProvider":{"type":"object","properties":{"type":{"type":"string","enum":["gitlab"]},"namespace":{"type":"string","maxLength":256,"description":"Group/project namespace"},"project":{"type":"string","maxLength":256,"description":"Project name"}},"required":["type","namespace","project"]},"Project":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"projectCapabilities":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"default":null,"required":["schemaVersion","capabilities"],"additionalProperties":false,"description":"Capabilities this Project may offer through setup links."},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","createdAt","workspaceId"]},"ProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","redirectUris"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"hasClientSecret":{"type":"boolean","enum":[true]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","clientId","hasClientSecret","redirectUris"]}]},"GcpOAuthClientId":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[a-zA-Z0-9_-]+-[a-zA-Z0-9_-]+\\.apps\\.googleusercontent\\.com$","description":"Google OAuth web client ID.","example":"1234567890-abc123.apps.googleusercontent.com"},"UpdateProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId"]}]},"GcpOAuthClientSecret":{"type":"string","minLength":1,"maxLength":512,"description":"Google OAuth web client secret. Write-only; never returned by the API.","example":"GOCSPX-example"},"UpdateProject":{"type":"object","properties":{"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"packagesConfigPatch":{"type":"object","properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"additionalProperties":false},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"additionalProperties":false},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"additionalProperties":false},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","nullable":true,"properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"additionalProperties":false}},"additionalProperties":false}},"additionalProperties":false}}},"DeploymentPortalDomainResponse":{"type":"object","properties":{"deploymentPortalEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"},"packageEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["deploymentPortalEndpoint","packageEndpoint"]},"DomainEndpoint":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dend_[0-9a-z]{28}$","description":"Unique identifier for the domain endpoint.","example":"dend_1bb6gdvm1bs74acqkjstcgv"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domainId":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"kind":{"$ref":"#/components/schemas/DomainEndpointKind"},"owner":{"$ref":"#/components/schemas/DomainEndpointOwner"},"hostname":{"type":"string","minLength":1,"maxLength":253},"status":{"$ref":"#/components/schemas/DomainEndpointStatus"},"provider":{"type":"string","nullable":true},"providerState":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"managedDnsRecords":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentPortalManagedDnsRecord"}},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"retryAttempts":{"type":"integer","minimum":0},"nextStepAfter":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","workspaceId","domainId","kind","owner","hostname","status","managedDnsRecords","retryAttempts","createdAt","updatedAt"]},"DomainEndpointKind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"DomainEndpointOwner":{"type":"object","properties":{"type":{"$ref":"#/components/schemas/DomainEndpointOwnerType"},"id":{"type":"string"}},"required":["type","id"]},"DomainEndpointOwnerType":{"type":"string","enum":["workspace","project","manager"]},"DomainEndpointStatus":{"type":"string","enum":["waiting_for_domain","provisioning","waiting_for_dns","waiting_for_health","active","failed","deleting"]},"DeploymentPortalManagedDnsRecord":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"value":{"type":"string"},"ttl":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true}},"required":["name","type","value"]},"DeploymentLinkSetupResponse":{"type":"object","properties":{"activeRelease":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","nullable":true},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true}},"required":["id","version","stack"]},"supportedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"setupItems":{"type":"array","items":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]}},"visiblePackageTypes":{"type":"array","items":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"}},"visibleSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"setupPackagesStatus":{"type":"string","enum":["preparing","ready","failed"],"description":"Whether at least one complete automated setup package is ready across all selected setup items."}},"required":["activeRelease","supportedPlatforms","setupItems","visiblePackageTypes","visibleSetupMethods","setupPackagesStatus"]},"StackByPlatform":{"type":"object","properties":{"aws":{"nullable":true},"gcp":{"nullable":true},"azure":{"nullable":true},"kubernetes":{"nullable":true},"machines":{"nullable":true},"local":{"nullable":true},"test":{"nullable":true}},"additionalProperties":false},"DeploymentSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform","helm","cli","manual"]},"ConfigureModelsRequest":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"minItems":1,"maxItems":100}},"required":["requirements"],"additionalProperties":false},"ProjectCapabilities":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"required":["schemaVersion","capabilities"],"additionalProperties":false},"AIProviderHeaders":{"type":"object","properties":{"providers":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"headers":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"},"value":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7E]*$"}},"required":["name","value"],"additionalProperties":false},"minItems":1,"maxItems":20}},"required":["provider","headers"],"additionalProperties":false},"maxItems":6}},"required":["providers"],"additionalProperties":false},"CapabilityMaterialization":{"type":"object","properties":{"projectCapabilities":{"$ref":"#/components/schemas/ProjectCapabilities"},"source":{"type":"object","properties":{"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"definitionVersion":{"type":"string"},"releaseId":{"type":"string"}},"required":["definitionId","definitionVersion","releaseId"]},"packages":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation","terraform","sandbox-bundle","gcp-sandbox-image"]},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"]}},"required":["type","status"]}}},"required":["projectCapabilities","source","packages"]},"ConfigureRemoteSandboxRequest":{"type":"object","properties":{"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800},"azureIdleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"additionalProperties":false},"SandboxBaseImageRepository":{"type":"object","properties":{"registryHost":{"type":"string","description":"Manager registry host to `docker login` to and push through."},"repository":{"type":"string","description":"This project's repository under that host."}},"required":["registryHost","repository"]},"ProjectCapabilityOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"configurationStatus":{"type":"string","enum":["valid","invalid"]},"hasAppRemoteSandbox":{"type":"boolean"},"summary":{"type":"object","properties":{"groups":{"type":"integer","minimum":0},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"keys":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"registry":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["groups","capabilities"]},"groups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"keys":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"buckets":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"registry":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"remoteSandbox":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["deploymentGroupId","name","externalId","createdAt","capabilities"]}}},"required":["generatedAt","configurationStatus","hasAppRemoteSandbox","summary","groups"]},"RemoteBindingsExternalAccessResponse":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1},"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","format":"uri"}},"required":["deploymentId","resourceId","accessToken","expiresIn","tokenType","managerUrl"]},"RemoteBindingsExternalAccessRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"capability":{"type":"string","enum":["storage","sandbox"]}},"required":["externalId","capability"],"additionalProperties":false},"RemoteOperatorInstallReceipt":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"renderedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","renderedAt"],"additionalProperties":false},"ObservedRemoteOperatorImageIdentity":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"observedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","observedAt"],"additionalProperties":false},"OperationsCatalogKubernetesPermissions":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsRule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false,"description":"Kubernetes RBAC required to execute this operation. Omitted by older servers and null when the operation declares none."},"OperationsCatalogKubernetesPermissionsRule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsVerb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"OperationsCatalogKubernetesPermissionsVerb":{"type":"string","enum":["get","list","watch","delete","patch"]},"RemoteOperatorPermissionPlugin":{"type":"object","properties":{"name":{"type":"string"},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"permissions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["aws","gcp"]},"kubernetesPermissions":{"type":"object","nullable":true,"properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"}},"required":["apiGroup","resource","verbs","reason"]}}},"required":["rules"]}},"required":["name","permissions"]}}},"required":["name","operations"]},"DeploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments allowed in this deployment group"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","externalId","projectId","workspaceId","createdAt"]},"CreateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments in this deployment group"}},"required":["name","project"]},"EnsureDeploymentGroupByNameRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["name","project"]},"EnsureDeploymentGroupByExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["externalId","name","project"]},"CreateSetupLinkResponse":{"allOf":[{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"},{"type":"object","properties":{"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroup"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"The persisted expiration date for the setup link"}},"required":["deploymentGroup","expiresAt"]}]},"CreateDeploymentGroupTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The API key token"},"deploymentLink":{"type":"string","description":"Formatted deployment link"}},"required":["token","deploymentLink"]},"CreateSetupLinkRequest":{"allOf":[{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"},{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"recoveryDeploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Recover Remote Operator bootstrap values for this exact existing group only if it has no deployments. Serialized with registration; never creates or rebinds a group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"}}}]},"DeploymentSetupConfigInput":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}}},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."}}},"DeploymentSetupMetadata":{"type":"object","additionalProperties":{"nullable":true}},"KubernetesClusterSource":{"type":"string","enum":["create","existing"]},"DeploymentSetupStackSettingsPolicy":{"type":"object","properties":{"defaults":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"allowedDeploymentModels":{"type":"array","items":{"type":"string","enum":["push","pull","airgapped"]}},"allowedNetworkModes":{"type":"array","items":{"type":"string","enum":["none","create","default","byo"]}},"allowedUpdatesModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required"]}},"allowedTelemetryModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required","off"]}},"allowedHeartbeatsModes":{"type":"array","items":{"type":"string","enum":["on","off"]}},"allowExternalBindings":{"type":"boolean"},"allowCustomRegistry":{"type":"boolean"}}},"EnvironmentVariableConfig":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"value":{"type":"string","maxLength":10000,"description":"Variable value (encrypted in database)"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","value","type","targetResources"]},"EnvironmentVariableType":{"type":"string","enum":["plain","secret"],"description":"Variable type (plain or secret)"},"DeploymentSetupItemSelection":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":{"type":"boolean"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"Deprecated request shorthand. Use deploymentSetupConfig.policy.allowedAIProviders."}},"required":["item","required"],"additionalProperties":false},"SetupLinkEntryPoint":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"provider":{"oneOf":[{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},{"type":"string","enum":["aws","gcp","azure"]}]}},"required":["item"],"additionalProperties":false,"description":"Portal destination to open first. This controls navigation, not authorization."},"StackInputValuesRequest":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{}},"StackInputValueRequest":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"type":"string"}}]},"ProjectIDOrNameQueryParam":{"type":"string","maxLength":100,"description":"Filter by project ID or name."},"SetDeploymentGroupExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"]},"UpdateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"maxDeployments":{"type":"integer","minimum":1,"description":"Maximum number of deployments in this deployment group"}}},"CreateDeploymentGroupTokenRequest":{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}}},"CreateFirstPartyDeploymentSessionResponse":{"type":"object","properties":{"token":{"type":"string","description":"The deployment-group session token"}},"required":["token"]},"ExternalAIBindingState":{"type":"object","properties":{"binding":{"$ref":"#/components/schemas/ExternalAIBinding"}},"required":["binding"]},"ExternalAIBinding":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"providerClientId":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialRevision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogProviderModelIds":{"type":"array","nullable":true,"items":{"type":"string"}},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"},"requiredModelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"available":{"type":"boolean","nullable":true},"accessStatus":{"type":"string","nullable":true,"enum":["verified","denied",null]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","available","accessStatus","accessObservedAt"]}},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","provider","providerEndpoint","providerClientId","keyFingerprint","credentialRevision","credentialStatus","credentialCheckedAt","catalogProviderModelIds","catalogObservedAt","requiredModelCoverage","updatedAt"]},"PutExternalAIBindingRequest":{"oneOf":[{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","openai"]},"apiKey":{"type":"string","minLength":1,"maxLength":512},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","apiKey","acknowledgeAlienCredentialAccess"],"additionalProperties":false},{"type":"object","properties":{"provider":{"type":"string","enum":["databricks"]},"workspaceUrl":{"type":"string","minLength":1,"maxLength":512},"clientId":{"type":"string","minLength":1,"maxLength":512},"clientSecret":{"type":"string","minLength":1,"maxLength":4096},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","workspaceUrl","clientId","clientSecret","acknowledgeAlienCredentialAccess"],"additionalProperties":false}]},"ExternalAIModelCheck":{"type":"object","properties":{"id":{"type":"string"},"publicModel":{"type":"string"},"status":{"type":"string","enum":["pending","running","verified","denied","failed","cancelled"]},"blockerCode":{"type":"string","nullable":true},"error":{"nullable":true},"requestedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","publicModel","status","blockerCode","requestedAt","completedAt"]},"ContainerRegistryState":{"type":"object","properties":{"route":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]},"endpoint":{"type":"object","nullable":true,"properties":{"url":{"type":"string","format":"uri"},"source":{"type":"string","enum":["runtime","custom-domain"]}},"required":["url","source"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]}}},"required":["route","endpoint","repositories","credentials"]},"CreateContainerRegistryCredentialResponse":{"type":"object","properties":{"credential":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]},"username":{"type":"string","enum":["alien"]},"password":{"type":"string"}},"required":["credential","username","password"]},"Package":{"type":"object","properties":{"id":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"type":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string","description":"Package version (e.g., '1.0.0', 'rel_abc123')"},"sourceReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release used as package build input. Null for release-less packages such as Operate Operator images.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"dependsOnPackageId":{"type":"string","nullable":true,"pattern":"pkg_[0-9a-z]{28}$","description":"Exact package dependency used as build input. Helm packages use this to identify the Operator image embedded in the chart.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"setupFingerprints":{"$ref":"#/components/schemas/SetupFingerprintMap"},"packageBuildInputHash":{"type":"string","description":"Hash of Platform-known package build request inputs: package type, source release, setup fingerprints, package config, and setup contract version"},"config":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"}},"required":["displayName","name"],"description":"Branding configuration for the deploy CLI binary."},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package paired with managed Kubernetes setup artifacts.\n\nThis is derived by the platform and is independent from the generic dependency, which\ncan point at a sandbox bundle for a mixed AWS and Kubernetes release."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for CloudFormation packages"},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image the agent binary is read from."},"baseImage":{"type":"string","description":"`custom_image` resolved to its linux/amd64 manifest, `registry/repository@sha256:...`."},"customImage":{"type":"string","description":"The developer's image as typed, which ties the package to the capability that asked."},"managerUrl":{"type":"string","description":"URL of the GCP manager whose registry proxy receives the push."}},"required":["agentImage","baseImage","customImage","managerUrl"],"description":"Configuration for a GCP sandbox image package.\n\nThe image is the developer's base with the sandbox agent and its contract layered on, pushed\ninto the project's path of the GCP manager's registry."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"managerUrl":{"type":"string","description":"Resolved default management endpoint captured when this build was queued."},"operationPermissions":{"type":"array","nullable":true,"items":{"type":"object","properties":{"operation":{"type":"string","description":"Operation name within the plugin."},"permissions":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Kubernetes API group. An empty string denotes the core API."},"reason":{"type":"string","description":"Human-readable reason the operation requires this rule."},"resource":{"type":"string","description":"Plural Kubernetes resource, optionally with a supported subresource."},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Optional concrete resource names. Empty means all names in the installation scope."},"verbs":{"type":"array","items":{"type":"string"},"description":"Concrete Kubernetes API verbs required by the operation."}},"required":["apiGroup","reason","resource","verbs"],"description":"One Kubernetes API requirement declared by an enabled operation."},"description":"Explicit Kubernetes API requirements."},"schemaVersion":{"type":"integer","minimum":0,"description":"Schema version of the validated permission declaration."}},"required":["rules","schemaVersion"],"description":"Versioned Kubernetes API requirements declared by an enabled operation."},"plugin":{"type":"string","description":"Operations plugin name."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier of an enabled operation in a Helm build snapshot."}},"required":["operation","permissions","plugin","tier"],"description":"Canonical Kubernetes permission snapshot for one enabled operation."},"description":"Canonical Kubernetes permissions for the operations enabled when this build was queued.\n\nThis is derived by the platform and persisted with the build request. It is not part of\nthe user-authored project package configuration. `None` identifies an older package row\nthat must be re-enqueued; an empty `Some` is a reviewed snapshot with no extra grants."},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","description":"Existing namespace claim instead of creating a new claim."},"size":{"type":"string","description":"Requested claim capacity, for example 1Gi."},"storageClassName":{"type":"string","description":"Cluster storage class; empty uses the cluster default."}},"required":["enabled","existingClaim","size","storageClassName"],"description":"Operator identity storage in the generated chart. This does not install a storage driver."},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","description":"Data key inside the Secret."},"name":{"type":"string","description":"Fixed Kubernetes Secret name expected by the workload's Secret mount."},"prefix":{"type":"string","description":"Plaintext prefix before the random alphanumeric suffix."},"randomLength":{"type":"integer","minimum":0,"description":"Length of the random suffix."}},"required":["key","name","prefix","randomLength"],"description":"Non-secret configuration for a chart-generated enrollment token."},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Empty string for the core Kubernetes API group."},"resources":{"type":"array","items":{"type":"string"},"description":"Kubernetes plural resource names; wildcards are not accepted."}},"required":["apiGroup","resources"],"description":"Resource family the chart grants get/list/watch over."},"description":"Exact API groups and resources. Verbs are fixed to get/list/watch."},"serviceAccountProfile":{"type":"string","description":"Permission profile used by the workload Container and generated ServiceAccount."}},"required":["rules","serviceAccountProfile"],"description":"Cluster reads granted to a workload identity, separate from Operator permissions."}},"required":["tokenSecret","workloadReadAccess"],"description":"Kubernetes resources created by the product chart before the runtime starts."}},"required":["chartName","description"],"description":"Configuration for the Helm chart package"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"}},"required":["displayName","name"],"description":"Branding configuration for the Operator image."},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image copied into the bundle."},"baseImage":{"type":"string","description":"The base container image the sandbox filesystem starts from. A release-pushed image\narrives resolved onto the private registry template with its {region} token intact."},"objectKey":{"type":"string","description":"Object key the bundle is written under in every regional bundle store."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store must receive this bundle. Part of the build input hash,\nso a newly supported region re-mints the bundle instead of silently missing it."}},"required":["agentImage","baseImage","objectKey"],"description":"Configuration for a sandbox bundle package.\n\nThe bundle is a zip holding one Dockerfile that layers the published Alien sandbox agent\nonto the vendor's base image; everything the builder writes is derived from these fields."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package used to compose managed Kubernetes modules.\n\nThis is derived by the platform and persisted with the build request. It is separate\nfrom the generic package dependency because a mixed AWS and Kubernetes release can also\ndepend on a sandbox bundle."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for Terraform package generation."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]}],"description":"Type-specific configuration"},"outputs":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"digest":{"type":"string","description":"Image digest (e.g., \"sha256:abc123...\")"},"image":{"type":"string","description":"Full image reference (e.g., \"public.ecr.aws/acme/operators/project-id:1.2.3\")"},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain packaged into the Operator image, if whitelabeled."}},"required":["digest","image"],"description":"Outputs from an Operator image package build"},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentDigest":{"type":"string","description":"Manifest digest of the linux/amd64 agent image the agent binary came from."},"baseDigest":{"type":"string","description":"Manifest digest of the linux/amd64 base the image was built from."},"digest":{"type":"string","description":"Manifest digest of the pushed image."},"image":{"type":"string","description":"Native registry reference pinned by digest, the value a GCP sandbox stack names."},"reuseKey":{"type":"string","description":"Hash of the base digest, the agent image reference and the image contract; equal keys reuse."}},"required":["agentDigest","baseDigest","digest","image","reuseKey"],"description":"Outputs from a GCP sandbox image package build."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"bundleUriTemplate":{"type":"string","description":"Bundle URI with the {region} token in the bucket, resolved by the deploy-time emitters."},"objectKey":{"type":"string","description":"Object key the bundle was written under in every regional bundle store."},"regions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store received this bundle."},"sha256":{"type":"string","description":"SHA256 checksum of the region-neutral bundle zip; a region-templated base image makes\neach regional object differ from it only in the rendered region."},"size":{"type":"integer","minimum":0,"description":"Region-neutral bundle zip size in bytes."}},"required":["bundleUriTemplate","objectKey","regions","sha256","size"],"description":"Outputs from a sandbox bundle package build."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]},{"nullable":true}],"description":"Package outputs (only when status is 'ready')"},"error":{"nullable":true,"description":"Error information if status is 'failed'"},"sourceBinarySha256":{"type":"string","nullable":true,"description":"Builder-recorded source binary SHA256 (for cli/terraform packages)"},"retries":{"type":"integer","minimum":0,"description":"Number of build retries"},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"leaseExpiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Expiration of the current builder lease"},"buildPhase":{"type":"string","nullable":true,"enum":["building","publishing",null],"description":"Coarse package build phase"},"lastProgressAt":{"type":"string","format":"date-time","nullable":true,"description":"Last successful builder lease renewal or phase change"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","projectId","workspaceId","type","status","version","setupFingerprints","packageBuildInputHash","config","retries","createdAt","updatedAt"]},"SetupFingerprintMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/SetupFingerprintInfo"},"description":"Per-target setup compatibility fingerprints copied from the source release"},"SetupFingerprintInfo":{"type":"object","properties":{"target":{"$ref":"#/components/schemas/SetupTarget"},"fingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"version":{"$ref":"#/components/schemas/SetupFingerprintVersion"}},"required":["target","fingerprint","version"]},"SetupTarget":{"type":"string","minLength":1,"description":"Stable target key for the setup contract, e.g. aws/us-east-1"},"SetupFingerprint":{"type":"string","minLength":1,"description":"Deterministic setup contract fingerprint for one setup target"},"SetupFingerprintVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup fingerprint algorithm version"},"ReleaseListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Release"},{"type":"object","properties":{"currentChannels":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannelName"},"description":"Channels for which this release is currently selected"},"commitUrl":{"type":"string","nullable":true,"format":"uri","description":"Validated canonical provider URL for the exact commit"},"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"rollout":{"type":"object","nullable":true,"properties":{"updatedCount":{"type":"integer","description":"Deployments that finished updating to this release (excludes initial provisions)"},"pendingCount":{"type":"integer","description":"Deployments currently targeting this release but not yet running it"},"avgDurationMs":{"type":"number","nullable":true,"description":"Average time from release creation until a deployment finished updating, in milliseconds"}},"required":["updatedCount","pendingCount","avgDurationMs"],"description":"Rollout stats, included when ?include=rollout is used"},"createdBy":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"User ID"},"name":{"type":"string","description":"User's display name"},"email":{"type":"string","description":"User's email address"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"}},"required":["id","name","email","image"],"description":"Platform user who created the release, included when ?include=createdBy is used"}},"required":["currentChannels","commitUrl"]}]},"ReleaseChannelName":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$"},"Release":{"type":"object","properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"projectId":{"type":"string","maxLength":128},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true},"setupFingerprints":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintMap"},{"description":"Per-target setup compatibility fingerprints for this release"}]},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"createdByUserId":{"type":"string","nullable":true,"maxLength":128,"description":"ID of the platform user who created the release, if known"},"workspaceId":{"type":"string","maxLength":128}},"required":["id","projectId","version","createdAt","setupFingerprints","workspaceId"]},"CreateReleaseRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"stack":{"$ref":"#/components/schemas/StackByPlatform"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"channel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Release channel to advance. Defaults to production."}]}},"required":["project"]},"ReleaseAuthorFilterItem":{"type":"object","properties":{"login":{"type":"string","nullable":true,"description":"Provider username (e.g., GitHub login)"},"name":{"type":"string","nullable":true,"description":"Git commit author name"},"avatarUrl":{"type":"string","nullable":true,"format":"uri","description":"Author avatar URL"}},"required":["login","name","avatarUrl"]},"ReleaseDeploymentsResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseDeploymentItem"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"},"stateCounts":{"$ref":"#/components/schemas/ReleaseRolloutStateCounts"}},"required":["items","nextCursor","stateCounts"]},"ReleaseDeploymentItem":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"deploymentGroup":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"],"description":"Deployment group this deployment belongs to"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"rolloutState":{"$ref":"#/components/schemas/ReleaseRolloutState"},"releasedAt":{"type":"string","format":"date-time","nullable":true,"description":"When this release went live on the deployment, null if it never did"},"durationMs":{"type":"integer","nullable":true,"description":"Time from release creation until the deployment finished updating, in milliseconds. Null for initial provisions and deployments that never ran this release."},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"}},"required":["id","name","status","platform","rolloutState","releasedAt","durationMs"]},"ReleaseRolloutState":{"type":"string","enum":["updated","updating","failed","pending","pinned-other","superseded","on-other"]},"ReleaseRolloutStateCounts":{"type":"object","properties":{"updated":{"type":"integer"},"updating":{"type":"integer"},"failed":{"type":"integer"},"pending":{"type":"integer"},"pinned-other":{"type":"integer"},"superseded":{"type":"integer"},"on-other":{"type":"integer"}},"required":["updated","updating","failed","pending","pinned-other","superseded","on-other"],"description":"Deployment counts per rollout state across all deployments the filters allow (ignores the state filter)"},"ReleaseChannel":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"deploymentCount":{"type":"integer","minimum":0},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","projectId","name","currentReleaseId","createdAt","updatedAt"]},"DeploymentListItemResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if in a failed state"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"$ref":"#/components/schemas/ManagerID"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentProtocolVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"DeploymentState protocol version owned by the runtime/manager"},"DeploymentPurpose":{"type":"string","enum":["application","encryption","ai","storage","container-registry","sandbox"],"description":"Operational purpose of this deployment within its customer environment."},"OperatorCapabilityReport":{"type":"object","properties":{"key":{"type":"string","minLength":1,"maxLength":128},"state":{"$ref":"#/components/schemas/OperatorCapabilityState"},"detail":{"type":"string","nullable":true,"maxLength":512}},"required":["key","state"]},"OperatorCapabilityState":{"type":"string","enum":["granted","denied","unavailable"]},"ManagerID":{"type":"string","pattern":"mgr_[0-9a-z]{28}$","description":"ID of the manager","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"DeploymentReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","minLength":1,"maxLength":256},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","version","createdAt"]},"DeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"]},"DeploymentProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"}},"required":["id","name"]},"DeploymentStats":{"type":"object","properties":{"total":{"type":"number","description":"Total number of deployments matching filters"},"byStatus":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by status (only includes statuses with non-zero counts)"},"byPlatform":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by platform (only includes platforms with non-zero counts)"},"byCurrentRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by currentReleaseId. The empty string key represents deployments with no current release (initial provisioning)."},"byPinnedRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by pinnedReleaseId among deployments that are pinned. Excludes unpinned deployments."},"byOrigin":{"type":"object","properties":{"framework":{"type":"number"},"remoteOperator":{"type":"number"}},"description":"Count of deployments introduced through each deployment path."}},"required":["total","byStatus","byPlatform","byCurrentRelease","byPinnedRelease","byOrigin"]},"DeploymentDetailResponse":{"allOf":[{"$ref":"#/components/schemas/Deployment"},{"type":"object","properties":{"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"},"operatorSync":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dosy_[0-9a-z]{28}$","description":"Unique identifier for the deployment operator sync.","example":"dosy_uxveigz3biyrosqycaqubbr"},"status":{"$ref":"#/components/schemas/DeploymentOperatorSyncStatus"},"stuckReason":{"$ref":"#/components/schemas/DeploymentOperatorSyncStuckReason"},"statusMessage":{"type":"string","nullable":true,"description":"Human-readable explanation of the status"},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash last reported by the Operator"},"missingOperations":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Expected `plugin/operation` names not reported by the Operator (catalog-mismatch only)"},"plugins":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/DeploymentOperatorSyncPlugin"},"description":"Enabled plugins compared with what the Operator last reported loading. Null when the sync fingerprints cannot be read."},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","targetBundleHash","targetSetAt"],"description":"Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments."}}}]},"ReportedOperation":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"name":{"type":"string","minLength":1,"maxLength":128}},"required":["plugin","pluginVersion","name"]},"DeploymentUpdateOperationSummary":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"status":{"$ref":"#/components/schemas/DeploymentUpdateOperationStatus"},"reasons":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentUpdateReason"}},"targetReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"changedKeys":{"type":"array","items":{"type":"string"}},"actionRequired":{"type":"string","nullable":true,"description":"Action needed before this update can execute; the current release remains installed."},"requestedAt":{"type":"string","format":"date-time"},"startedAt":{"type":"string","format":"date-time","nullable":true},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","reasons","targetReleaseId","changedKeys","requestedAt"]},"DeploymentUpdateOperationStatus":{"type":"string","enum":["blocked","queued","applying","succeeded","failed","superseded"]},"DeploymentUpdateReason":{"type":"string","enum":["configuration","redeploy","release"]},"DeploymentOperatorSyncStatus":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"DeploymentOperatorSyncStuckReason":{"type":"string","nullable":true,"enum":["download-failed","sync-stalled","catalog-mismatch",null]},"DeploymentOperatorSyncPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string","description":"Version the Operator should run"},"source":{"type":"string","enum":["builtin","custom"]},"state":{"type":"string","enum":["running","adding","updating","removing"],"description":"What the Operator still has to do for this plugin"},"previousVersion":{"type":"string","nullable":true,"description":"Version the Operator is running now (only while updating)"}},"required":["name","version","source","state"]},"Deployment":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentConnectionInfo":{"type":"object","properties":{"arc":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Manager URL for commands"},"deploymentId":{"type":"string","description":"Deployment ID to use in command requests"}},"required":["url","deploymentId"]},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"publicEndpoints":{"type":"object","additionalProperties":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"protocol":{"type":"string","enum":["http","tcp"]},"host":{"type":"string","minLength":1},"port":{"type":"integer","minimum":1,"maximum":65535},"wildcardHost":{"type":"string"}},"required":["url","protocol","host","port"]},"description":"Public endpoints keyed by endpoint name."}},"required":["type"]},"description":"Deployed resources and their public endpoints"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string"}},"required":["arc","resources","status","platform"]},"CreateDeploymentResponse":{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/Deployment"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Effective deployment model persisted for the deployment."},"token":{"type":"string","description":"Deployment token (only returned when using deployment group token)"}},"required":["deployment","deploymentModel"]},"NewDeploymentRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentGroupId":{"type":"string","description":"Required for workspace/project tokens. Deployment group tokens use their own group automatically."},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Optional manager to assign. If omitted, the project default or system manager is selected."}]},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"environmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"},"description":"Configuration of environment variables for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"Stack settings for deployment customization"},"resourcePrefix":{"$ref":"#/components/schemas/ResourcePrefix"},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method that created the deployment. Defaults to cli."}]},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup method metadata used to guide privileged teardown."}]},"inputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{},"description":"Stack input values provided by the deployment creator."},"operatorScope":{"type":"string","minLength":1,"maxLength":512,"description":"Display-only scope reported by the Operator manifest."},"operatorPermission":{"type":"string","minLength":1,"maxLength":64,"description":"Display-only permission tier reported by the Operator manifest."},"initialDesiredRelease":{"type":"string","enum":["active","none"],"default":"active","description":"Desired-release selection for a new deployment. Use none to register an environment without initially requesting a release; later updates can assign one."},"releaseChannel":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","default":"production","description":"Release channel followed while this deployment is not pinned."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Customer setup item selected from this deployment-group token."},"setupHandoff":{"type":"string","enum":["immediate","await-registration"],"default":"immediate","description":"Use await-registration when CloudFormation will create the infrastructure and register this deployment."}},"required":["name","platform","project"],"additionalProperties":false,"description":"Request schema for creating a new deployment"},"ResourcePrefix":{"type":"string","pattern":"^[a-z](?:[a-z0-9]|-(?=[a-z0-9])){1,38}[a-z0-9]$","description":"Optional physical-name prefix for generated cloud resources. Omit to let the manager generate one."},"ImportDeploymentRequest":{"oneOf":[{"$ref":"#/components/schemas/ForwardImportRequest"},{"$ref":"#/components/schemas/PersistImportedDeploymentRequest"}],"description":"Request schema for importing a deployment from resolved setup infrastructure"},"ForwardImportRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["forward"],"default":"forward"},"project":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user-session callers."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Required for user-session callers. Deployment-group tokens use their own group automatically.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager ID. If omitted, the first suitable manager for the source platform is used."}]},"source":{"$ref":"#/components/schemas/ImportSource"},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Exact item selected from a tailored customer setup link."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["source"]},"ImportSource":{"type":"object","properties":{"deploymentName":{"type":"string","minLength":1,"description":"User-chosen deployment name. Must be unique within the deployment group; the manager returns 409 on collision."},"resourcePrefix":{"allOf":[{"$ref":"#/components/schemas/ResourcePrefix"},{"description":"Stable physical-name prefix used by the setup artifact."}]},"sourceKind":{"$ref":"#/components/schemas/ImportSourceKind"},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup source metadata needed to guide privileged teardown."}]},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release that produced the setup artifact. Defaults to latest.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Cloud platform of the imported stack"},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"region":{"type":"string","description":"Region or location reported by the setup artifact"},"setupTarget":{"allOf":[{"$ref":"#/components/schemas/SetupTarget"},{"description":"Setup target this package was generated for"}]},"setupImportFormatVersion":{"$ref":"#/components/schemas/SetupImportFormatVersion"},"setupFingerprint":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprint"},{"description":"Setup compatibility fingerprint embedded in the package"}]},"setupFingerprintVersion":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintVersion"},{"description":"Setup fingerprint algorithm version embedded in the package"}]},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ImportedResource"},"minItems":1}},"required":["deploymentName","resourcePrefix","platform","region","setupTarget","setupImportFormatVersion","setupFingerprint","setupFingerprintVersion","stackSettings","resources"],"description":"Resolved setup import payload"},"ImportSourceKind":{"type":"string","enum":["cloudformation","terraform","helm"],"description":"Source label for observability only — does not affect import behavior."},"KubernetesBasePlatform":{"type":"string","enum":["aws","gcp","azure"],"description":"Base cloud platform for cloud-backed Kubernetes imports."},"SetupImportFormatVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup import payload format version embedded in the package"},"ImportedResource":{"type":"object","properties":{"id":{"type":"string","description":"Resource id from the active stack"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"importData":{"type":"object","additionalProperties":{"nullable":true},"description":"Resolved typed import payload"}},"required":["id","type","importData"]},"PersistImportedDeploymentRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["persist"]},"name":{"type":"string","minLength":1,"description":"Deployment name. Must be unique within the deployment group."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"stackState":{"nullable":true},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"runtimeMetadata":{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},"scheduleReconciliation":{"type":"boolean","default":false},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"default":"provisioning","description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"currentReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"importSource":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"setupMetadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"setupTarget":{"$ref":"#/components/schemas/SetupTarget"},"setupFingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"setupFingerprintVersion":{"$ref":"#/components/schemas/SetupFingerprintVersion"},"deploymentToken":{"type":"string"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["mode","name","deploymentGroupId","managerId","platform","stackSettings","runtimeMetadata","deploymentProtocolVersion","setupTarget","setupFingerprint","setupFingerprintVersion"]},"SetFirstPartyDeploymentInputsResponse":{"type":"object","properties":{"ok":{"type":"boolean"}},"required":["ok"]},"SetFirstPartyDeploymentInputsRequest":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"releaseChannel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["platform"]},"SetupRegistrationOperationResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"status":{"$ref":"#/components/schemas/SetupRegistrationOperationStatus"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"physicalResourceId":{"type":"string","nullable":true},"result":{"$ref":"#/components/schemas/SetupRegistrationOperationResult"},"error":{"type":"object","nullable":true,"properties":{"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["message","retryable"]}},"required":["id","action","sourceKind","status","deploymentId","physicalResourceId","result","error"]},"SetupRegistrationAction":{"type":"string","enum":["create","update","delete"]},"SetupRegistrationOperationStatus":{"type":"string","enum":["pending","processing","waiting-for-handoff","succeeded","failed","responding","responded"]},"SetupRegistrationOperationResult":{"type":"object","nullable":true,"properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentToken":{"type":"string","nullable":true},"helmValues":{"type":"string","nullable":true}},"required":["deploymentId","deploymentToken","helmValues"]},"CreateSetupRegistrationOperationRequest":{"type":"object","properties":{"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"source":{"allOf":[{"$ref":"#/components/schemas/ImportSource"}],"nullable":true},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":512},"cloudFormation":{"$ref":"#/components/schemas/SetupRegistrationCloudFormationTarget"}},"required":["action","sourceKind"],"additionalProperties":false},"SetupRegistrationCloudFormationTarget":{"type":"object","nullable":true,"properties":{"stackId":{"type":"string","minLength":1},"requestId":{"type":"string","minLength":1},"logicalResourceId":{"type":"string","minLength":1},"responseUrl":{"type":"string","format":"uri"},"physicalResourceId":{"type":"string","nullable":true,"minLength":1},"serviceTimeoutSeconds":{"type":"integer","minimum":60,"maximum":7200,"default":3300}},"required":["stackId","requestId","logicalResourceId","responseUrl"],"additionalProperties":false},"DeleteDeploymentResponse":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]},"message":{"type":"string"}},"required":["action","message"]},"DeleteDeploymentRequest":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]}},"required":["action"]},"PinReleaseRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release ID to pin the deployment to. Set to null to resume its followed channel.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for pinning/unpinning deployment release"},"DeploymentInputsResponse":{"type":"object","properties":{"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"values":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"description":"Current non-secret input values. Secret values are never returned."},"providedInputIds":{"type":"array","items":{"type":"string"},"description":"Input IDs that currently have a value, including redacted secrets."}},"required":["inputs","values","providedInputIds"]},"UpdateDeploymentComputeRequest":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]}}},"UpdateDeploymentInputsResponse":{"allOf":[{"$ref":"#/components/schemas/DeploymentInputsResponse"},{"type":"object","properties":{"runtimeUpdateRequested":{"type":"boolean"},"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["runtimeUpdateRequested","outcome","operation"]}]},"UpdateDeploymentInputsRequest":{"type":"object","properties":{"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"clearInputIds":{"type":"array","items":{"type":"string"},"default":[]}},"additionalProperties":false},"UpdateDeploymentEnvironmentVariablesRequest":{"type":"object","properties":{"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"value":{"type":"string","description":"Variable value"},"type":{"type":"string","enum":["plain","secret"],"description":"Variable type"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources)"}},"required":["name","value","type"]},"description":"Environment variables for the deployment"}},"required":["variables"],"additionalProperties":false,"description":"Request schema for updating deployment environment variables"},"CreateDeploymentTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The generated deployment token (only shown once)"},"deploymentId":{"type":"string","description":"The deployment ID that this token is scoped to"}},"required":["token","deploymentId"]},"CreateDeploymentTokenRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128,"description":"Optional description for the deployment token"},"expiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Optional expiration date for the deployment token"}},"required":["description"]},"DynamicContainerResponse":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"appliedGeneration":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"statusMessage":{"type":"string","nullable":true},"internalServices":{"type":"array","items":{"type":"object","properties":{"internalDns":{"type":"string"},"port":{"type":"integer"}},"required":["internalDns","port"]}},"deleted":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["name","spec","generation","appliedGeneration","status","statusMessage","internalServices","deleted","createdAt","updatedAt"]},"DynamicContainerName":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"DynamicContainerSpec":{"type":"object","properties":{"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"resources":{"type":"object","properties":{"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"}},"required":["cpu","memory"]},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192},"default":{}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]}},"required":["image","resources","replicas","ports"],"additionalProperties":false},"PutDynamicContainerRequest":{"type":"object","properties":{"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}}},"required":["spec"],"additionalProperties":false},"ListDeploymentMachinesResponse":{"type":"object","properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentMachine"}}},"required":["machines"]},"DeploymentMachine":{"type":"object","properties":{"clusterResourceId":{"type":"string"},"machineId":{"type":"string"},"status":{"type":"string"},"capacityGroup":{"type":"string"},"zone":{"type":"string"},"cpu":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"memory":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"storage":{"type":"object","nullable":true,"properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"workloadId":{"type":"string","nullable":true},"workloadName":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true},"schedulingMode":{"type":"string","nullable":true},"state":{"type":"string","nullable":true}},"required":["reason"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"overlayIp":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"horizondVersion":{"type":"string","nullable":true},"networkHealth":{"type":"string","enum":["unknown","healthy","degraded"]},"wireguardMesh":{"type":"object","nullable":true,"properties":{"expectedPeerCount":{"type":"integer","minimum":0},"reachablePeerCount":{"type":"integer","minimum":0},"missingPeerMachineIds":{"type":"array","items":{"type":"string"}}},"required":["expectedPeerCount","reachablePeerCount","missingPeerMachineIds"]},"wireguardMeshObservedAt":{"type":"string","nullable":true},"localOverrides":{"type":"array","items":{"type":"object","properties":{"activeDigest":{"type":"string","nullable":true},"actor":{"type":"string","nullable":true},"baseAssignmentHash":{"type":"string"},"baseDigest":{"type":"string","nullable":true},"candidateDigest":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"failureCategory":{"type":"string","nullable":true},"fallbackDigest":{"type":"string","nullable":true},"forcedStop":{"type":"boolean","nullable":true},"healthySince":{"type":"string","nullable":true},"incidentId":{"type":"string","nullable":true},"lifecycle":{"type":"string"},"phaseStartedAt":{"type":"string","nullable":true},"replicaId":{"type":"string"},"workloadName":{"type":"string"}},"required":["baseAssignmentHash","lifecycle","replicaId","workloadName"]}},"localOverridesObservedAt":{"type":"string","nullable":true},"replicaCount":{"type":"integer"}},"required":["clusterResourceId","machineId","status","capacityGroup","zone","cpu","memory","drainBlockers","drainForce","lastHeartbeat","localOverrides","replicaCount"]},"DeploymentCredentialRotationStatus":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0},"rotation":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}},"required":["deploymentId","revision","rotation"]},"DeploymentCredentialRotation":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"expiresAt":{"type":"string"}},"required":["id","revision","status","expiresAt"]},"DeploymentCredentialRotationValues":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"token":{"type":"string"}},"required":["deploymentId","revision","token"]},"CreateManagerResponse":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["pending"]},"setupToken":{"type":"string"},"setupTokenId":{"type":"string"},"deploymentLink":{"type":"string"},"setupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"inputValues":{"$ref":"#/components/schemas/EncryptedStackInputValues"},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8,"description":"Immutable setup items and exact sources captured when this setup link is created."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string","enum":["plain","secret"]},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"}}},"required":["name","type","targetResources"]}}},"required":["metadata","policy","environmentVariables"]},"setup":{"oneOf":[{"type":"object","properties":{"method":{"type":"string","enum":["cloudformation"]},"deploymentPortalUrl":{"type":"string"},"launchUrl":{"type":"string"},"templateUrl":{"type":"string"},"stackName":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","launchUrl","templateUrl","stackName","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["google-oauth"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"oauthStartUrl":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","oauthStartUrl","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["terraform"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"providerSource":{"type":"string"},"moduleSource":{"type":"string"},"moduleVersion":{"type":"string"},"moduleInputs":{"type":"object","additionalProperties":{"type":"string"}},"mainTf":{"type":"string"},"tfvars":{"type":"string"},"commands":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","providerSource","moduleSource","moduleInputs","mainTf","tfvars","commands","stackSettings"]}]}},"required":["managerId","setupStatus","setupToken","setupTokenId","deploymentLink","setupConfig","setup"]},"DeploymentSetupPolicy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}},"required":["allowedPlatforms","allowedSetupMethods"]},"EncryptedStackInputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/EncryptedStackInputValue"},"default":{}},"EncryptedStackInputValue":{"type":"object","properties":{"value":{"type":"string","description":"Encrypted JSON-encoded input value."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"]},"secret":{"type":"boolean","description":"Whether the original input is secret."}},"required":["value","kind","secret"]},"NewManagerRequest":{"type":"object","properties":{"name":{"type":"string"},"cloud":{"$ref":"#/components/schemas/PrivateManagerCloud"},"region":{"type":"string","minLength":1,"maxLength":64,"description":"Cloud region for the manager."},"setupMethod":{"$ref":"#/components/schemas/PrivateManagerSetupMethod"},"network":{"type":"string","enum":["create","default"],"description":"Optional network mode for the private-manager setup. Defaults to create for production isolation; default uses the provider default network for faster dev/test setup."},"otlpConfig":{"type":"object","properties":{"logsEndpoint":{"type":"string","format":"uri","description":"External OTLP logs endpoint (e.g. https://api.axiom.co/v1/logs)"},"logsAuthHeader":{"type":"string","description":"Auth header in 'key=value,...' format (e.g. 'authorization=Bearer <token>,x-axiom-dataset=<dataset>')"}},"required":["logsEndpoint","logsAuthHeader"],"description":"Optional external OTLP config for forwarding logs to Axiom, Datadog, etc. Falls back to built-in DeepStore when not set."}},"required":["name","cloud","region"]},"PrivateManagerCloud":{"type":"string","enum":["aws","gcp","azure"],"description":"Cloud where the private manager will be deployed."},"PrivateManagerSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform"],"description":"Optional setup method. Defaults to cloudformation for AWS, google-oauth for GCP, and terraform for Azure."},"ManagerRetryResponse":{"oneOf":[{"allOf":[{"$ref":"#/components/schemas/CreateManagerResponse"},{"type":"object","properties":{"mode":{"type":"string","enum":["setup"]}},"required":["mode"]}]},{"$ref":"#/components/schemas/ManagerRetryDeploymentResponse"}]},"ManagerRetryDeploymentResponse":{"type":"object","properties":{"mode":{"type":"string","enum":["deployment"]},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["provisioning"]},"deploymentId":{"type":"string"},"message":{"type":"string"}},"required":["mode","managerId","setupStatus","deploymentId","message"]},"Manager":{"type":"object","properties":{"id":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for the manager"}]},"name":{"type":"string","description":"Display name of the manager"},"targets":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms this manager can handle"},"cloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where this private manager is deployed"},"region":{"type":"string","nullable":true,"description":"Cloud region selected for this private manager"},"setupStatus":{"type":"string","nullable":true,"enum":["pending","provisioning","active","failed","deleting","deleted",null],"description":"Private manager setup lifecycle status"},"url":{"type":"string","nullable":true,"format":"uri","description":"Manager URL (self-reported via heartbeat). DeepStore endpoints are exposed through this URL (e.g., {url}/v1/logs)"},"managementConfigs":{"$ref":"#/components/schemas/ManagerManagementConfigs"},"isSystem":{"type":"boolean","description":"Whether this is a system manager (Alien-hosted)"},"workspaceId":{"type":"string","description":"The workspace ID (for system managers, this is ALIEN_WORKSPACE_ID)"},"status":{"$ref":"#/components/schemas/ManagerStatus"},"version":{"type":"string","nullable":true,"description":"Manager version (self-reported via heartbeat)"},"metrics":{"type":"object","nullable":true,"properties":{"activeDeployments":{"type":"number","description":"Number of active deployments"},"pendingDeployments":{"type":"number","description":"Number of pending deployments"},"memoryUsageMb":{"type":"number","description":"Memory usage in megabytes"},"cpuUsagePercent":{"type":"number","description":"CPU usage percentage"}},"description":"Runtime metrics (self-reported via heartbeat)"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the manager"},"logsDatabaseId":{"type":"string","nullable":true,"description":"ID of the logs database associated with this manager"},"managedDeploymentCount":{"type":"integer","minimum":0,"description":"Number of deployments currently being managed by this manager"},"defaultProjectCount":{"type":"integer","minimum":0,"description":"Number of projects that select this manager as a default manager"},"createdAt":{"type":"string","format":"date-time","description":"Timestamp when the manager was created"}},"required":["id","name","targets","managementConfigs","isSystem","workspaceId","status","managedDeploymentCount","defaultProjectCount","createdAt"],"description":"Manager schema"},"ManagerManagementConfigs":{"type":"object","properties":{"aws":{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"},"platform":{"type":"string","enum":["aws"]}},"required":["managingRoleArn","platform"]},"gcp":{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"},"platform":{"type":"string","enum":["gcp"]}},"required":["serviceAccountEmail","platform"]},"azure":{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."},"platform":{"type":"string","enum":["azure"]}},"required":["managingTenantId","oidcIssuer","oidcSubject","platform"]},"kubernetes":{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}},"description":"Per-platform management configurations for cross-account access (self-reported via heartbeat)"},"ManagerStatus":{"type":"string","enum":["healthy","degraded","unhealthy","unknown"],"description":"Current health status"},"ManagerDomainBindingResponse":{"type":"object","properties":{"managerDomainBinding":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["managerDomainBinding"]},"UpdateManagerDomainBinding":{"type":"object","properties":{"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"}},"additionalProperties":false},"UpdateManagerRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Optional release ID to update to. If not provided, the active release will be chosen","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for updating a manager to a new release"},"Event":{"type":"object","properties":{"id":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"debugSessionId":{"type":"string","nullable":true,"pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"data":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["LoadingConfiguration"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["Finished"]}},"required":["type"]},{"type":"object","properties":{"stack":{"type":"string","description":"Name of the stack being built"},"type":{"type":"string","enum":["BuildingStack"]}},"required":["stack","type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform being targeted"},"stack":{"type":"string","description":"Name of the stack being checked"},"type":{"type":"string","enum":["RunningPreflights"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"targetTriple":{"type":"string","description":"Target triple for the runtime"},"type":{"type":"string","enum":["DownloadingAlienRuntime"]},"url":{"type":"string","description":"URL being downloaded from"}},"required":["targetTriple","type","url"]},{"type":"object","properties":{"relatedResources":{"type":"array","items":{"type":"string"},"description":"All resource names sharing this build (for deduped container groups)"},"resourceName":{"type":"string","description":"Name of the resource being built"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["BuildingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being built"},"type":{"type":"string","enum":["BuildingImage"]}},"required":["image","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being pushed"},"progress":{"oneOf":[{"type":"object","properties":{"bytesUploaded":{"type":"integer","minimum":0,"description":"Bytes uploaded so far"},"layersUploaded":{"type":"integer","minimum":0,"description":"Number of layers uploaded so far"},"operation":{"type":"string","description":"Current operation being performed"},"totalBytes":{"type":"integer","minimum":0,"description":"Total bytes to upload"},"totalLayers":{"type":"integer","minimum":0,"description":"Total number of layers to upload"}},"required":["bytesUploaded","layersUploaded","operation","totalBytes","totalLayers"],"description":"Progress information for image push operations"},{"nullable":true}]},"type":{"type":"string","enum":["PushingImage"]}},"required":["image","type"]},{"type":"object","properties":{"destination":{"type":"string","nullable":true,"description":"Human-readable destination for pushed images"},"platform":{"type":"string","description":"Target platform"},"stack":{"type":"string","description":"Name of the stack being pushed"},"type":{"type":"string","enum":["PushingStack"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"resourceName":{"type":"string","description":"Name of the resource being pushed"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["PushingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"project":{"type":"string","description":"Project name"},"type":{"type":"string","enum":["CreatingRelease"]}},"required":["project","type"]},{"type":"object","properties":{"language":{"type":"string","description":"Language being compiled (rust, typescript, etc.)"},"progress":{"type":"string","nullable":true,"description":"Current progress/status line from the build output"},"type":{"type":"string","enum":["CompilingCode"]}},"required":["language","type"]},{"type":"object","properties":{"nextState":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},"suggestedDelayMs":{"type":"integer","nullable":true,"minimum":0,"description":"An suggested duration to wait before executing the next step."},"type":{"type":"string","enum":["StackStep"]}},"required":["nextState","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["GeneratingCloudFormationTemplate"]}},"required":["type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform for which the template is being generated"},"type":{"type":"string","enum":["GeneratingTemplate"]}},"required":["platform","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being provisioned"},"releaseId":{"type":"string","description":"ID of the release being deployed to the agent"},"type":{"type":"string","enum":["ProvisioningAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being updated"},"releaseId":{"type":"string","description":"ID of the new release being deployed to the agent"},"type":{"type":"string","enum":["UpdatingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being deleted"},"releaseId":{"type":"string","description":"ID of the release that was running on the agent"},"type":{"type":"string","enum":["DeletingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being debugged"},"debugSessionId":{"type":"string","description":"ID of the debug session"},"type":{"type":"string","enum":["DebuggingAgent"]}},"required":["agentId","debugSessionId","type"]},{"type":"object","properties":{"strategyName":{"type":"string","description":"Name of the deployment strategy being used"},"type":{"type":"string","enum":["PreparingEnvironment"]}},"required":["strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being deployed"},"type":{"type":"string","enum":["DeployingStack"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being tested"},"type":{"type":"string","enum":["RunningTestWorker"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpStack"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpEnvironment"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"platformName":{"type":"string","description":"Name of the platform (e.g., \"AWS\", \"GCP\")"},"type":{"type":"string","enum":["SettingUpPlatformContext"]}},"required":["platformName","type"]},{"type":"object","properties":{"repositoryName":{"type":"string","description":"Name of the docker repository"},"type":{"type":"string","enum":["EnsuringDockerRepository"]}},"required":["repositoryName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeployingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"roleArn":{"type":"string","description":"ARN of the role to assume"},"type":{"type":"string","enum":["AssumingRole"]}},"required":["roleArn","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"type":{"type":"string","enum":["ImportingStackStateFromCloudFormation"]}},"required":["cfnStackName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeletingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"bucketNames":{"type":"array","items":{"type":"string"},"description":"Names of the S3 buckets being emptied"},"type":{"type":"string","enum":["EmptyingBuckets"]}},"required":["bucketNames","type"]},{"type":"object","properties":{"deploymentGroupId":{"type":"string","description":"ID of the deployment group this slot belongs to"},"deploymentId":{"type":"string","description":"ID of the deployment that was created"},"releaseId":{"type":"string","nullable":true,"description":"Initial release the slot was created with, if any"},"type":{"type":"string","enum":["DeploymentCreated"]}},"required":["deploymentGroupId","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously live, if any"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentReleased"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release the platform was trying to deploy, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"phase":{"type":"string","enum":["preflights","provisioning","updating","deleting"],"description":"Phase of a deployment at which a failure occurred.\n\nDerived from the source deployment status: `preflights-failed` →\n`Preflights`, `provisioning-failed` → `Provisioning`, `update-failed` →\n`Updating`, `delete-failed` → `Deleting`.\n`refresh-failed` is modelled separately via `DeploymentDegraded`."},"type":{"type":"string","enum":["DeploymentFailed"]}},"required":["deploymentId","error","phase","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"type":{"type":"string","enum":["DeploymentDegraded"]}},"required":["deploymentId","error","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentRecovered"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment that was deleted"},"type":{"type":"string","enum":["DeploymentDeleted"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Name of the channel that moved"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously current, if any"},"releaseId":{"type":"string","description":"ID of the release that is now current"},"type":{"type":"string","enum":["ReleaseChannelUpdated"]}},"required":["channel","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Newly followed channel"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousChannel":{"type":"string","description":"Previously followed channel"},"type":{"type":"string","enum":["DeploymentReleaseChannelChanged"]}},"required":["channel","deploymentId","previousChannel","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release that the failed attempt was targeting, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousError":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"type":{"type":"string","enum":["DeploymentRetryRequested"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release being redeployed"},"type":{"type":"string","enum":["DeploymentRedeployRequested"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"pinnedReleaseId":{"type":"string","description":"ID of the release that is now pinned"},"previousPinnedReleaseId":{"type":"string","nullable":true,"description":"ID of the previously pinned release, if any"},"type":{"type":"string","enum":["DeploymentReleasePinned"]}},"required":["deploymentId","pinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousPinnedReleaseId":{"type":"string","description":"ID of the release that was previously pinned"},"type":{"type":"string","enum":["DeploymentReleaseUnpinned"]}},"required":["deploymentId","previousPinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"changedKeys":{"type":"array","items":{"type":"string"},"description":"Names of the environment variables that changed (added, removed, or modified)"},"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentEnvironmentUpdated"]}},"required":["changedKeys","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentDeletionRequested"]}},"required":["deploymentId","type"]},{"$ref":"#/components/schemas/DeploymentCredentialRotationEvent"}]},"state":{"oneOf":[{"type":"object","properties":{"failed":{"type":"object","properties":{"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]}},"description":"Event failed with an error"}},"required":["failed"]},{"type":"string","enum":["none"]},{"type":"string","enum":["started"]},{"type":"string","enum":["success"]}],"description":"Represents the state of an event"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","data","state","projectId","createdAt","workspaceId"]},"DeploymentCredentialRotationEvent":{"type":"object","properties":{"type":{"type":"string","enum":["DeploymentCredentialRotation"]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"rotationId":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"previousKeyId":{"type":"string"},"candidateKeyId":{"type":"string"},"actor":{"type":"object","properties":{"kind":{"type":"string","enum":["user","serviceAccount"]},"id":{"type":"string"}},"required":["kind","id"]}},"required":["type","deploymentId","rotationId","revision","status","previousKeyId","candidateKeyId","actor"]},"GenerateManagerTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string","description":"Platform JWT for authenticating with the manager"},"expiresIn":{"type":"number","nullable":true,"description":"Token lifetime in seconds"},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","description":"Manager URL for direct access"},"databaseId":{"type":"string","nullable":true,"description":"Log database ID (null if logs not configured)"},"controlPlaneUrl":{"type":"string","nullable":true,"description":"Log control plane URL (null if logs not configured)"}},"required":["accessToken","expiresIn","tokenType","managerUrl","databaseId","controlPlaneUrl"]},"GenerateManagerTokenRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to scope token access to."}},"required":["project"]},"GenerateManagerBindingTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string"}},"required":["accessToken","expiresIn","tokenType","managerUrl"]},"GenerateManagerBindingTokenRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"kind":{"type":"string","enum":["data","sandbox"],"description":"Binding kind the token resolves. Defaults to the deployment's own kind: sandbox for a sandbox deployment, data otherwise."}},"required":["deploymentId"],"additionalProperties":false},"ResolveManagerGcpOAuthProviderResponse":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId","clientSecret"]}]},"ResolveManagerGcpOAuthProviderRequest":{"type":"object","properties":{"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group bearer token whose project-level OAuth provider should be resolved."},"returnOrigin":{"type":"string","format":"uri","description":"Browser origin that will receive the Google OAuth callback result. Must be a first-party dashboard origin or the active portal origin for the deployment group's project."}},"required":["deploymentGroupToken"]},"ManagerHeartbeatResponse":{"type":"object","properties":{"acknowledged":{"type":"boolean"},"timestamp":{"type":"string"}},"required":["acknowledged","timestamp"]},"ManagerHeartbeatRequest":{"type":"object","properties":{"status":{"type":"string","enum":["healthy","degraded","unhealthy"],"description":"Current health status"},"version":{"type":"string","description":"Manager version"},"url":{"type":"string","format":"uri","description":"Manager public URL (for accessing DeepStore endpoints)"},"managementConfigs":{"allOf":[{"$ref":"#/components/schemas/ManagerManagementConfigs"},{"description":"Per-platform management configurations for cross-account access"}]},"metrics":{"type":"object","properties":{"activeDeployments":{"type":"number"},"pendingDeployments":{"type":"number"},"memoryUsageMb":{"type":"number"},"cpuUsagePercent":{"type":"number"}},"description":"Optional runtime metrics"}},"required":["status","url","managementConfigs"]},"ManagerDeployment":{"type":"object","properties":{"platform":{"type":"string","description":"Platform of the internal deployment"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status of the internal deployment"},"deploymentId":{"type":"string","description":"Internal deployment ID"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Currently deployed private manager release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Target private manager release for an in-progress update","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"error":{"nullable":true,"description":"Latest provision / upgrade / delete error"},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type"},"status":{"type":"string","description":"Resource status"},"outputs":{"type":"object","additionalProperties":{"nullable":true},"description":"Resource outputs"}},"required":["type","status"]},"description":"Simplified stack state resources"},"environmentInfo":{"nullable":true,"description":"Manager environment info"}},"required":["platform","status","deploymentId","resources"]},"ContainerRegistryManagerSnapshot":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"routes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string"},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"routableUpstreamName":{"type":"string","nullable":true},"remoteResourceRevision":{"type":"string"}},"required":["id","logicalName","desiredState","routableUpstreamName","remoteResourceRevision"],"additionalProperties":false}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"secretPrefix":{"type":"string"},"secretDigest":{"type":"string","pattern":"^[0-9a-f]{64}$"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","secretPrefix","secretDigest","scope","repositorySubset","expiresAt","revokedAt"],"additionalProperties":false}}},"required":["id","deploymentId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","repositories","credentials"],"additionalProperties":false}}},"required":["generatedAt","routes"],"additionalProperties":false},"ApplyContainerRegistrySnapshotResponse":{"type":"object","properties":{"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["applying","connected","degraded","revoked"]}},"required":["appliedRevision","status"],"additionalProperties":false},"PrepareOperatorManifestPackageResponse":{"type":"object","properties":{"package":{"$ref":"#/components/schemas/Package"}},"required":["package"]},"PrepareOperatorManifestPackageRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}},"required":["project"],"additionalProperties":false},"RenderOperatorManifestResponse":{"type":"object","properties":{"manifest":{"type":"string","description":"Rendered multi-document Kubernetes manifest"},"applyCommand":{"type":"string","description":"kubectl command for applying the manifest from a file"},"filename":{"type":"string","description":"Suggested local filename"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the manifest"},"imagePending":{"type":"boolean","description":"True when the operator image is still building. The manifest contains a placeholder image (<PENDING_IMAGE>) and must not be applied yet — re-render once the operator-image package is ready to get the real image."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["manifest","applyCommand","filename","managerUrl","imagePending","operatorImage"]},"RenderOperatorManifestRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"format":{"type":"string","enum":["raw","helm"],"default":"raw","description":"raw: a kubectl-applyable manifest for one cluster. helm: a paste-into-your-chart template whose namespace and environment name come from Helm at install time."},"environmentName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Per-environment identity. Required for raw output, ignored for helm.","example":"my-app"},"namespace":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([-a-z0-9]*[a-z0-9])?$","description":"Namespace to observe and install into. Omit for helm to use the release namespace."},"scope":{"type":"string","enum":["namespace","cluster"],"default":"namespace","description":"namespace: a namespaced Role that manages the install namespace. cluster: a ClusterRole that manages every namespace."},"labelSelector":{"type":"string","minLength":1,"maxLength":256,"description":"Optional Kubernetes label selector narrowing what is managed, applied within the scope."},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to use for the Operator image. If omitted, the latest ready operator-image package for the project is used.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group token embedded in the operator Secret"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","default":false},"podLabelKey":{"type":"string","minLength":1,"description":"Existing Pod label key to collect logs from. Set with podLabelValue."},"podLabelValue":{"type":"string","minLength":1,"description":"Existing Pod label value to collect logs from. Set with podLabelKey."}},"description":"Enable the node log collector DaemonSet for raw pod logs."},"stackSettings":{"$ref":"#/components/schemas/StackSettings"}},"required":["project","deploymentGroupToken"],"additionalProperties":false},"StackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"EcsBootstrapWriteCheckRequest":{"type":"object","properties":{"stackName":{"type":"string","pattern":"^[A-Za-z][A-Za-z0-9-]{0,127}$"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"}},"required":["stackName","accountId","region","clusterArn"],"additionalProperties":false},"RenderOperatorEcsCloudFormationResponse":{"type":"object","properties":{"template":{"type":"string","nullable":true,"description":"CloudFormation JSON for an ECS Fargate service, or null while the immutable Operator image is building. The artifact contains no bootstrap credential values."},"filename":{"type":"string","description":"Suggested local CloudFormation filename"},"stackName":{"type":"string","description":"Suggested stack name for this installation"},"deployCommand":{"type":"string","nullable":true,"description":"Local bash/zsh deploy command, or null while the image is building. Before writing a bootstrap secret, it asks Alien to verify the one-time setup token and registration state, then preserves or generates the encryption key and writes both to customer-owned Secrets Manager. Once an Operator has registered from this stack, it reuses the stored secret at its current version and never asks for a token. It passes only the secret ARN and version ID to CloudFormation."},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the task definition"},"image":{"type":"string","description":"Immutable Operator image reference, or <PENDING_IMAGE>"},"imagePending":{"type":"boolean","description":"True until a ready Operator image digest is available. A pending template must not be deployed."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["template","filename","stackName","deployCommand","managerUrl","image","imagePending","operatorImage"]},"RenderOperatorEcsCloudFormationRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"environmentName":{"type":"string","minLength":2,"maxLength":100,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Stable per-environment Remote Operator installation name"},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"},"subnetIds":{"type":"array","items":{"type":"string","pattern":"^subnet-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact subnet ID for an Operator task ENI"},"minItems":1,"maxItems":16},"securityGroupIds":{"type":"array","items":{"type":"string","pattern":"^sg-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact security group ID for an Operator task ENI"},"minItems":1,"maxItems":16},"assignPublicIp":{"type":"string","enum":["DISABLED","ENABLED"],"default":"DISABLED"},"efsFileSystemId":{"type":"string","pattern":"^fs-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS filesystem ID for the Operator identity. Omit it, with efsAccessPointId, to have the stack create retained EFS storage."},"efsAccessPointId":{"type":"string","pattern":"^fsap-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS access point ID (POSIX UID and GID 1000) on efsFileSystemId. Supply it together with efsFileSystemId."},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to pin in the task definition. If omitted, the current project package is prepared or reused.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"s3BucketArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$","description":"Exact ARN of an S3 bucket the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned S3 ceiling. Required when enabled S3 operations need ListBucket or GetObject; the generated role contains only these bucket and object ARNs."},"sqsQueueArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):sqs:[a-z0-9]+(?:-[a-z0-9]+)+:[0-9]{12}:(?:[A-Za-z0-9_-]{1,80}|[A-Za-z0-9_-]{1,75}\\.fifo)$","description":"Exact ARN of an SQS queue the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned SQS ceiling. Required when enabled SQS operations read queue attributes; the generated role contains only these queue ARNs."}},"required":["project","environmentName","accountId","region","clusterArn","subnetIds","securityGroupIds"],"additionalProperties":false},"APIKey":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"},"createdByUser":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"email":{"type":"string"},"image":{"type":"string","nullable":true}},"required":["id","email","image"],"description":"User information associated with the API key"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig","createdByUser"],"description":"API key information"},"APIKeyDeploymentSetupConfig":{"type":"object","nullable":true,"properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/APIKeyDeploymentSetupEnvironmentVariable"}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8}},"required":["metadata","policy","environmentVariables"]},"APIKeyDeploymentSetupEnvironmentVariable":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]},"CreateAPIKeyResponse":{"type":"object","properties":{"apiKey":{"type":"string","description":"The generated API key value (only shown once)"},"keyInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig"]}},"required":["apiKey","keyInfo"],"description":"Response containing the new API key and its metadata"},"CreateAPIKeyRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"scope":{"$ref":"#/components/schemas/Scope"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"required":["description","scope","expiresAt"],"description":"Request schema for creating a new API key"},"Scope":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceScope"},{"$ref":"#/components/schemas/ProjectScope"},{"$ref":"#/components/schemas/DeploymentScope"},{"$ref":"#/components/schemas/DeploymentGroupScope"},{"$ref":"#/components/schemas/ManagerScope"}],"discriminator":{"propertyName":"type","mapping":{"workspace":"#/components/schemas/WorkspaceScope","project":"#/components/schemas/ProjectScope","deployment":"#/components/schemas/DeploymentScope","deployment-group":"#/components/schemas/DeploymentGroupScope","manager":"#/components/schemas/ManagerScope"}},"description":"Scope and role configuration for service accounts"},"WorkspaceScope":{"type":"object","properties":{"type":{"type":"string","enum":["workspace"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["type","role"],"description":"Workspace-scoped configuration"},"ProjectScope":{"type":"object","properties":{"type":{"type":"string","enum":["project"]},"projectId":{"type":"string","description":"ID of the project this is scoped to"},"role":{"$ref":"#/components/schemas/ProjectRole"}},"required":["type","projectId","role"],"description":"Project-scoped configuration"},"DeploymentScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment"]},"deploymentId":{"type":"string","description":"ID of the deployment this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"},"role":{"$ref":"#/components/schemas/DeploymentRole"}},"required":["type","deploymentId","projectId","role"],"description":"Deployment-scoped configuration"},"DeploymentGroupScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"]},"deploymentGroupId":{"type":"string","description":"ID of the deployment group this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"},"role":{"$ref":"#/components/schemas/DeploymentGroupRole"}},"required":["type","deploymentGroupId","projectId","role"],"description":"Deployment group-scoped configuration"},"ManagerScope":{"type":"object","properties":{"type":{"type":"string","enum":["manager"]},"managerId":{"type":"string","description":"ID of the manager this is scoped to"},"role":{"$ref":"#/components/schemas/ManagerRole"}},"required":["type","managerId","role"],"description":"Manager-scoped configuration"},"UpdateAPIKeyRequest":{"type":"object","properties":{"enabled":{"type":"boolean"},"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"deploymentSetupConfig":{"$ref":"#/components/schemas/UpdateDeploymentSetupPolicy"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"description":"Request schema for updating an API key"},"UpdateDeploymentSetupPolicy":{"type":"object","properties":{"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"}},"required":["policy"],"description":"Editable part of a deployment link's setup config. Locked env vars and input values are preserved."},"DeleteAPIKeysRequest":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"minItems":1}},"required":["ids"]},"DomainWithUsage":{"allOf":[{"$ref":"#/components/schemas/Domain"},{"type":"object","properties":{"endpoints":{"type":"array","items":{"$ref":"#/components/schemas/DomainEndpoint"}},"usage":{"type":"object","properties":{"deploymentUrlProjects":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"portalBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true},"hostname":{"type":"string"}},"required":["id","projectId","projectName","hostname"]}},"packageDomains":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"hostname":{"type":"string"}},"required":["id","hostname"]}},"managerBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"managerId":{"type":"string"},"managerName":{"type":"string"},"hostname":{"type":"string"}},"required":["id","managerId","managerName","hostname"]}}},"required":["deploymentUrlProjects","portalBindings","packageDomains","managerBindings"]}},"required":["endpoints","usage"]}]},"Domain":{"type":"object","properties":{"id":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domain":{"type":"string"},"isSystem":{"type":"boolean"},"claimToken":{"type":"string"},"hostedZoneId":{"type":"string","nullable":true},"nameServers":{"type":"array","nullable":true,"items":{"type":"string"}},"status":{"type":"string","enum":["pending-zone-creation","pending-verification","verified","lost-verification","failed","deleting"]},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verifiedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","workspaceId","domain","isSystem","claimToken","status","createdAt","updatedAt"]},"EventListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Event"},{"type":"object","properties":{"releaseCreatedAt":{"type":"string","format":"date-time","nullable":true,"description":"createdAt of the event's referenced release, included when ?include=releaseCreatedAt is used"}}}]},"IncidentListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Incident"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"],"additionalProperties":false},"Incident":{"type":"object","properties":{"id":{"type":"string"},"number":{"type":"integer","minimum":0,"exclusiveMinimum":true},"reference":{"type":"string"},"title":{"type":"string"},"scopeLabel":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true},"sessionStatus":{"type":"string","nullable":true,"enum":["queued","running","halted","complete","error","canceled",null]},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","number","reference","title","scopeLabel","agentSessionId","sessionStatus","projectId","deploymentId","releaseId","createdAt","updatedAt"],"additionalProperties":false},"IncidentResponse":{"type":"object","properties":{"incident":{"$ref":"#/components/schemas/Incident"}},"required":["incident"],"additionalProperties":false},"ListMachinesJoinTokensResponse":{"type":"object","properties":{"tokens":{"type":"array","items":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"}}},"required":["tokens"]},"MachinesJoinTokenSummary":{"type":"object","properties":{"id":{"type":"string"},"createdAt":{"type":"string"},"createdBy":{"type":"string"},"expiresAt":{"type":"string","nullable":true},"maxJoins":{"type":"integer","nullable":true},"joinCount":{"type":"integer"},"lastUsedAt":{"type":"string","nullable":true},"revokedAt":{"type":"string","nullable":true}},"required":["id","createdAt","createdBy","joinCount"]},"CreateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RotateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RevokeMachinesJoinTokenResponse":{"type":"object","properties":{"tokenId":{"type":"string"},"revoked":{"type":"boolean"}},"required":["tokenId","revoked"]},"CancelMachinesMachineDrainResponse":{"type":"object","properties":{"machineId":{"type":"string"},"cancelled":{"type":"boolean"}},"required":["machineId","cancelled"]},"DrainMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"requested":{"type":"boolean"}},"required":["machineId","requested"]},"DrainMachinesMachineRequest":{"type":"object","properties":{"deadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"force":{"type":"boolean"}}},"RemoveMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"removed":{"type":"boolean"}},"required":["machineId","removed"]},"CommandBootstrapResponse":{"type":"object","properties":{"managerUrl":{"type":"string","format":"uri","description":"Current customer-facing manager URL"},"token":{"type":"string","minLength":1,"description":"Short-lived command capability token"},"expiresAt":{"type":"string","format":"date-time","description":"Capability expiry in RFC 3339 format"},"target":{"$ref":"#/components/schemas/CommandReceiverBootstrapTarget"}},"required":["managerUrl","token","expiresAt"]},"CommandReceiverBootstrapTarget":{"type":"object","properties":{"resourceId":{"type":"string"},"resourceType":{"type":"string","enum":["container","daemon"]}},"required":["resourceId","resourceType"],"description":"Resolved target identity; present only for receiver bootstrap"},"CommandBootstrapRequest":{"oneOf":[{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["sender"]}},"required":["deploymentId","role"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["receiver"]},"target":{"type":"string","minLength":1,"maxLength":255}},"required":["deploymentId","role","target"],"additionalProperties":false}]},"CommandListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Command"},{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/CommandDeploymentInfo"},"project":{"$ref":"#/components/schemas/CommandProjectInfo"}}}]},"CommandVerification":{"type":"object","nullable":true,"properties":{"state":{"type":"string","enum":["not-required","pending","verified","failed","skipped"],"description":"Verification outcome of an operation command."},"reason":{"type":"string","nullable":true,"description":"Present for 'failed' and 'skipped'."}},"required":["state","reason"],"description":"Verification outcome of an operation command; null for commands that are not operations"},"CommandDeploymentInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/CommandDeploymentGroupInfo"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"managerId":{"type":"string","description":"Manager ID for obtaining access tokens"},"managerUrl":{"type":"string","nullable":true,"format":"uri","description":"URL of the manager for direct payload access"},"managerName":{"type":"string","nullable":true,"description":"Human-readable name of the manager"},"managerIsSystem":{"type":"boolean","nullable":true,"description":"Whether the manager is Alien-hosted (system)"}},"required":["id","name","managerId"]},"CommandDeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"CommandProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string"}},"required":["id","name"]},"Command":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","description":"Command name (e.g., 'analyze-repository', 'sync-data')"},"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Command states in the Commands protocol lifecycle"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Delivery mode for this command (push/pull), derived from the target at creation time"},"target":{"type":"object","nullable":true,"properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to; null on commands created before target routing"},"attempt":{"type":"number","nullable":true,"description":"Current attempt number"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","nullable":true,"description":"Size of command params in bytes"},"responseSizeBytes":{"type":"number","nullable":true,"description":"Size of command response in bytes"},"createdAt":{"type":"string","format":"date-time","description":"When the command was created"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command was dispatched to the deployment"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command completed"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if command failed"},"accessRequestId":{"type":"string","nullable":true,"description":"The approved access request that authorized this operation command, if one did"},"verification":{"$ref":"#/components/schemas/CommandVerification"},"result":{"nullable":true,"description":"Decoded command result when available"},"resultAvailability":{"type":"string","enum":["available","protected"],"description":"Whether a successful operation result is included or withheld pending explicit confirmation"}},"required":["id","deploymentId","projectId","workspaceId","name","state","deploymentModel","target","attempt","deadline","requestSizeBytes","responseSizeBytes","createdAt","dispatchedAt","completedAt","error","accessRequestId","verification"]},"ListCommandNamesResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}}},"required":["names"]},"ListCommandDeploymentsResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"required":["id","name"]}}},"required":["deployments"]},"CreateCommandResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"projectId":{"type":"string","description":"Project ID (for manager to use in routing)"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"How to dispatch the command"},"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to"},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How the command is delivered to its target"},"operationResultContractPersisted":{"type":"boolean","description":"Whether an operation result contract was stored atomically with this command"}},"required":["id","projectId","deploymentModel","target","deliveryMode","operationResultContractPersisted"]},"CreateCommandRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Target deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":1,"maxLength":255,"description":"Command name (e.g., 'analyze-repository')"},"params":{"nullable":true,"description":"Command parameters for public invocation"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key for public invocation retries. Requires params; use null for a command without arguments. Reuse the same key and identical request to recover the original command for up to 24 hours. Scoped to the workspace, caller, deployment, resolved target, and command name. The first accepted request wins; changed params or deadlines do not create a new command with the same key. Omit for a new invocation without retry protection."},"target":{"type":"string","maxLength":255,"description":"Resource id the command is addressed to. Required when the deployment has more than one command-capable resource."},"initialState":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Initial state (PENDING_UPLOAD if params require upload, PENDING if inline)"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Size of command params in bytes"},"operationResultContract":{"nullable":true,"description":"Opaque operation result contract with an optional accessRequestId binding, forwarded by a manager and persisted atomically before dispatch"}},"required":["deploymentId","name"]},"ResolvedCommandTarget":{"type":"object","properties":{"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Identifies the specific resource a command is addressed to."},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How a command is delivered to its target resource.\n\nThis is a Commands-protocol-specific concept and is intentionally distinct\nfrom `DeploymentModel` (see `stack_settings.rs`), which governs the\ninfrastructure-level push/pull wiring for a deployment. Serialized\nlowercase for consistency with `CommandTargetType`."}},"required":["target","deliveryMode"]},"UpdateCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"New command state"},"attempt":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Current attempt number"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command was dispatched"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}}},"DispatchCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"DispatchCommandRequest":{"type":"object","properties":{"dispatchedAt":{"type":"string","format":"date-time","description":"When the command was dispatched"}},"required":["dispatchedAt"]},"CompleteCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"CompleteCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["SUCCEEDED","FAILED","EXPIRED"],"description":"Terminal state to transition to"},"completedAt":{"type":"string","format":"date-time","description":"When the command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}},"required":["state","completedAt"]},"IncrementCommandAttemptResponse":{"type":"object","properties":{"attempt":{"type":"integer","description":"The attempt number after the increment"}},"required":["attempt"]},"DebugSessionListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DebugSession"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"},"DebugSession":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"owner":{"type":"string","nullable":true,"maxLength":128},"state":{"$ref":"#/components/schemas/DebugSessionState"},"mode":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"provider":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Represents the target cloud platform."},"presignedUrls":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DebugPackagePresignedURLs"}},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","state","mode","presignedUrls","createdAt","expiresAt","deploymentId","projectId","workspaceId"]},"DebugSessionState":{"type":"string","enum":["pending","running","stopping","stopped","expired","failed"]},"DebugPackagePresignedURLs":{"type":"object","properties":{"readUrl":{"type":"string","maxLength":2048,"format":"uri"},"writeUrl":{"type":"string","maxLength":2048,"format":"uri"}},"required":["readUrl","writeUrl"]},"CreateDebugSessionRequest":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Override the generated id. Manager passes the registry session id so logs correlate.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"owner":{"type":"string","nullable":true,"maxLength":128},"expiresAt":{"type":"string","format":"date-time"},"state":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Initial state. Defaults to 'pending'."}]},"accessRequestId":{"type":"string","description":"The caller's own access request whose debug grant authorized this session, for the same deployment."}},"required":["deploymentId","expiresAt"]},"UpdateDebugSessionRequest":{"type":"object","properties":{"state":{"$ref":"#/components/schemas/DebugSessionState"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"expiresAt":{"type":"string","format":"date-time"}}},"DeploymentInfo":{"type":"object","properties":{"setupUpdate":{"type":"object","properties":{"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"releaseId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"}],"nullable":true},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"}],"nullable":true},"setupTarget":{"type":"string","nullable":true},"resourcePrefix":{"type":"string","nullable":true},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["deploymentId","updateOperationId","releaseId","name","platform","setupMethod","setupMetadata","setupTarget","resourcePrefix","stackSettings"]},"tokenType":{"type":"string","enum":["deployment","deployment-group"],"description":"Type of token used to authenticate this request"},"deployment":{"type":"object","properties":{"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["name","platform"],"description":"Deployment details (present when using a deployment-scoped token)"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"pinnedSubdomain":{"type":"string","nullable":true}},"required":["id","name","pinnedSubdomain"],"description":"Deployment group details (present when using a deployment-group token)"},"workspace":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"avatarUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name"]},"project":{"type":"object","properties":{"name":{"type":"string"},"portal":{"type":"object","properties":{"appearance":{"$ref":"#/components/schemas/DeploymentPortalAppearance"}},"required":["appearance"]},"stackSummary":{"type":"object","nullable":true,"properties":{"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms supported by the active release"},"requiresNetwork":{"type":"boolean","description":"Whether the stack contains resources that require cloud VPC networking"},"customerModels":{"type":"boolean","description":"Whether this release offers one remotely accessible AI resource"},"resourceCounts":{"type":"object","properties":{"workers":{"type":"integer","minimum":0},"containers":{"type":"integer","minimum":0},"daemons":{"type":"integer","minimum":0,"description":"Daemon resources that run on managed runtime machines"},"publicHttpsEndpoints":{"type":"integer","minimum":0,"description":"Resources that declare managed public HTTPS endpoint setup"},"externalInfra":{"type":"integer","minimum":0,"description":"Storage, queue, KV, vault, database, or cache resources that Kubernetes needs Terraform to provision"},"total":{"type":"integer","minimum":0}},"required":["workers","containers","publicHttpsEndpoints","externalInfra","total"]},"publicEndpoints":{"type":"array","items":{"type":"object","properties":{"resourceId":{"type":"string"},"endpointName":{"type":"string"},"hostLabel":{"type":"string"},"wildcardSubdomains":{"type":"boolean"}},"required":["resourceId","endpointName","hostLabel","wildcardSubdomains"]},"description":"Public endpoints declared by the active release stack"}},"required":["platforms","requiresNetwork","customerModels","resourceCounts","publicEndpoints"]},"generatedDomain":{"type":"object","nullable":true,"properties":{"domain":{"type":"string"},"isSystem":{"type":"boolean"}},"required":["domain","isSystem"],"description":"Parent domain for generated deployment URLs. Chosen public subdomains are only allowed when isSystem is false."}},"required":["name","portal"]},"packages":{"type":"object","properties":{"ready":{"type":"boolean","description":"True if all enabled packages are ready for deployment"},"cli":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"commandName":{"type":"string","description":"CLI command name to use in install instructions"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},"error":{"nullable":true},"installScripts":{"type":"object","properties":{"windows":{"type":"string","format":"uri"},"mac":{"type":"string","format":"uri"},"linux":{"type":"string","format":"uri"}},"required":["windows","mac","linux"],"description":"Install script URLs for each OS"}},"required":["status","commandName","installScripts"]},"cloudformation":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},"error":{"nullable":true},"mode":{"type":"string","enum":["auto","outputs"]},"launchUrl":{"type":"string","format":"uri","description":"CloudFormation launch URL"},"outputsSchema":{"nullable":true}},"required":["status","mode","launchUrl"]},"terraform":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},"error":{"nullable":true},"providerSource":{"type":"string","description":"Terraform provider source (without https://)"},"moduleSources":{"type":"object","additionalProperties":{"type":"string"},"description":"Terraform module sources by target"},"moduleVersion":{"type":"string"},"managerUrls":{"type":"object","additionalProperties":{"type":"string"},"description":"Manager URLs by Terraform target"}},"required":["status","providerSource","moduleSources","managerUrls"]},"helm":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},"error":{"nullable":true},"chartRef":{"type":"string","description":"OCI chart reference"},"managerUrlOverride":{"type":"string","format":"uri","description":"Management endpoint to supply only when this chart's captured default differs from current installation routing."},"managerFetchExample":{"type":"string"},"localImportExample":{"type":"string"}},"required":["status","chartRef"]}},"required":["ready"]},"installContext":{"type":"object","properties":{"targets":{"type":"object","additionalProperties":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managerUrl":{"type":"string","format":"uri"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"awsManagingAccountId":{"type":"string"}},"required":["platform","managerUrl"]},"description":"Deployment-session install context by Terraform/installer target"}},"required":["targets"]},"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"},"modelAvailabilitySources":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"status":{"type":"string","enum":["current","stale","invalid"]},"availability":{"$ref":"#/components/schemas/AiAvailabilityObservation"}},"required":["deploymentId","resourceId","observedAt","status"]}},"setupItems":{"type":"array","items":{"$ref":"#/components/schemas/SetupItemStatus"}},"setupConfig":{"$ref":"#/components/schemas/DeploymentInfoSetupConfig"},"readiness":{"type":"object","properties":{"status":{"type":"string","enum":["ready","notReady","unknown"]},"checks":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"status":{"type":"string","enum":["passed","failed","warning","unknown"]},"message":{"type":"string"},"checkedAt":{"type":"string"}},"required":["code","status","message","checkedAt"]}}},"required":["status","checks"]}},"required":["tokenType","workspace","project","packages","installContext","supportedRegions","modelAvailabilitySources"]},"DeploymentPortalAppearance":{"type":"object","properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}}},"SupportedCloudRegions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by this Alien environment."},"gcp":{"type":"array","items":{"type":"string"},"description":"GCP regions supported by this Alien environment."},"azure":{"type":"array","items":{"type":"string"},"description":"Azure locations supported by this Alien environment."}},"required":["aws","gcp","azure"]},"AiAvailabilityObservation":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"SetupItemStatus":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false},"status":{"type":"string","enum":["not-started","waiting","applying","verifying","connected","needs-attention","revoked"]},"deploymentIds":{"type":"array","items":{"type":"string"}},"blocker":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]}},"required":["item","source","required","status","deploymentIds"],"additionalProperties":false},"DeploymentInfoSetupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"inputValues":{"type":"array","items":{"$ref":"#/components/schemas/ResolvedStackInputSummary"}}},"required":["metadata","policy","environmentVariables"]},"ResolvedStackInputSummary":{"type":"object","properties":{"id":{"type":"string"},"label":{"type":"string"},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"]}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"provided":{"type":"boolean"}},"required":["id","label","providedBy","required","secret","provided"]},"DeploymentComputePlan":{"type":"object","properties":{"pools":{"type":"array","items":{"type":"object","properties":{"poolId":{"type":"string"},"workloads":{"type":"array","items":{"type":"string"}},"requirements":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"scale":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["fixed"]},"machines":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","machines"]},{"type":"object","properties":{"type":{"type":"string","enum":["autoscale"]},"min":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]},"max":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","min","max"]}]},"selected":{"$ref":"#/components/schemas/ComputePoolSelection"},"recommended":{"$ref":"#/components/schemas/ComputePoolSelection"},"machines":{"type":"array","items":{"type":"object","properties":{"machine":{"type":"string"},"profile":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"recommended":{"type":"boolean"}},"required":["machine","profile","recommended"]}},"errors":{"type":"array","items":{"type":"string"}}},"required":["poolId","workloads","requirements","scale","selected","recommended","machines"]}}},"required":["pools"]},"ComputePoolSelection":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"PreparedDeploymentStack":{"type":"object","properties":{"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"setup":{"$ref":"#/components/schemas/SetupFingerprintInfo"}},"required":["platform","stack","setup"]},"SlackInstallUrlResponse":{"type":"object","properties":{"url":{"type":"string","format":"uri"}},"required":["url"]},"SlackIntegrationStatus":{"type":"object","properties":{"connected":{"type":"boolean"},"slackTeamId":{"type":"string","nullable":true},"slackTeamName":{"type":"string","nullable":true},"installedByUserId":{"type":"string","nullable":true},"installedAt":{"type":"string","nullable":true},"notificationChannelId":{"type":"string","nullable":true}},"required":["connected","slackTeamId","slackTeamName","installedByUserId","installedAt","notificationChannelId"]},"SlackChannelsResponse":{"type":"object","properties":{"channels":{"type":"array","items":{"$ref":"#/components/schemas/SlackChannel"}}},"required":["channels"]},"SlackChannel":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"isMember":{"type":"boolean"}},"required":["id","name","isMember"]},"SlackNotificationChannelResponse":{"type":"object","properties":{"notificationChannelId":{"type":"string","nullable":true},"warning":{"type":"string","nullable":true}},"required":["notificationChannelId","warning"]},"SlackNotificationChannelRequest":{"type":"object","properties":{"channelId":{"type":"string","nullable":true}},"required":["channelId"]},"AgentSessionListResponse":{"type":"object","properties":{"sessions":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionListItem"}}},"required":["sessions"]},"AgentSessionListItem":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"subjectId":{"type":"string"},"subject":{"$ref":"#/components/schemas/AgentSessionSubject"},"status":{"type":"string"},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","triggerType","subjectId","subject","status","createdAt","updatedAt"]},"AgentSessionSubject":{"type":"object","properties":{"deploymentName":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"releaseCommitMessage":{"type":"string","nullable":true},"releaseCommitRef":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true}},"required":["deploymentName","deploymentGroupId","deploymentGroupName","releaseId","releaseCommitMessage","releaseCommitRef","projectId","projectName"]},"AgentSessionDetail":{"allOf":[{"$ref":"#/components/schemas/AgentSessionListItem"},{"type":"object","properties":{"resultText":{"type":"string","nullable":true},"toolNames":{"type":"array","nullable":true,"items":{"type":"string"}},"error":{"type":"string","nullable":true}},"required":["resultText","toolNames","error"]}]},"AgentSessionEventsResponse":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionEvent"}},"latestSeq":{"type":"number"},"hasMore":{"type":"boolean"}},"required":["events","latestSeq","hasMore"]},"AgentSessionEvent":{"oneOf":[{"$ref":"#/components/schemas/AgentSessionStatusEvent"},{"$ref":"#/components/schemas/AgentSessionStepEvent"},{"$ref":"#/components/schemas/AgentSessionToolCallEvent"},{"$ref":"#/components/schemas/AgentSessionToolResultEvent"},{"$ref":"#/components/schemas/AgentSessionMarkdownEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalRequestedEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalGrantedEvent"},{"$ref":"#/components/schemas/AgentSessionRestartedEvent"},{"$ref":"#/components/schemas/AgentSessionEventsTruncatedEvent"}],"discriminator":{"propertyName":"type","mapping":{"status":"#/components/schemas/AgentSessionStatusEvent","step":"#/components/schemas/AgentSessionStepEvent","tool_call":"#/components/schemas/AgentSessionToolCallEvent","tool_result":"#/components/schemas/AgentSessionToolResultEvent","markdown":"#/components/schemas/AgentSessionMarkdownEvent","approval_requested":"#/components/schemas/AgentSessionApprovalRequestedEvent","approval_granted":"#/components/schemas/AgentSessionApprovalGrantedEvent","session_restarted":"#/components/schemas/AgentSessionRestartedEvent","events_truncated":"#/components/schemas/AgentSessionEventsTruncatedEvent"}}},"AgentSessionStatusEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["status"]},"payload":{"type":"object","properties":{"status":{"type":"string"},"error":{"type":"string"}},"required":["status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStepEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["step"]},"payload":{"type":"object","properties":{"stepId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["in_progress","complete","error"]}},"required":["stepId","title","status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolCallEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolResultEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_result"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string","nullable":true},"toolName":{"type":"string","nullable":true},"ok":{"type":"boolean"},"output":{"nullable":true}},"required":["toolCallId","toolName","ok"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionMarkdownEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["markdown"]},"payload":{"type":"object","properties":{"text":{"type":"string"}},"required":["text"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalRequestedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_requested"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["approvalId","toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalGrantedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_granted"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"approvedByUserId":{"type":"string"},"approvedByName":{"type":"string","nullable":true},"source":{"type":"string","enum":["dashboard","slack"]}},"required":["approvalId","approvedByUserId","approvedByName","source"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionRestartedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["session_restarted"]},"payload":{"type":"object","properties":{"reason":{"type":"string"}},"required":["reason"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionEventsTruncatedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["events_truncated"]},"payload":{"type":"object","properties":{"limit":{"type":"number"}},"required":["limit"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStopResponse":{"type":"object","properties":{"jobId":{"type":"string"},"status":{"type":"string"},"canceled":{"type":"boolean"}},"required":["jobId","status","canceled"]},"ListOperationsPluginsResponse":{"type":"object","properties":{"plugins":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPlugin"}},"installations":{"$ref":"#/components/schemas/OperatorInstallationsRollup"}},"required":["plugins","installations"]},"OperationsPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default tier."},"builtin":{"type":"boolean","description":"True for compiled-in plugins, false for custom bundles."},"enabled":{"type":"boolean"},"operations":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPluginOperation"}}},"required":["name","version","tier","builtin","enabled","operations"]},"OperationsPluginOperation":{"type":"object","properties":{"name":{"type":"string","description":"Operation name, unique within the plugin."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier for this operation."},"description":{"type":"string","nullable":true,"description":"Human-readable description."},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for operation parameters when the plugin publishes one."},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for a successful result when the plugin publishes one."},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string"},"pollOperation":{"type":"string"},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string"}},"successField":{"type":"string"},"successValue":{"type":"string"},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"timeoutSeconds":{"type":"integer","minimum":1}},"required":["changes","pollOperation","pollParamsFromResult","successField","successValue","timeoutSeconds"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"requiredPermissions":{"type":"array","items":{"type":"string"},"description":"IDs of permission sets (see alien-permissions) this operation requires. Empty when the operation declares none."},"permissions":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetesPermissions":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["name","tier","description","inputSchema","outputSchema","timeoutSeconds","retries","verification","sensitiveOutput","requiredPermissions","permissions"]},"OperatorInstallationsRollup":{"type":"object","properties":{"total":{"type":"integer","minimum":0,"description":"Total pull-mode installations tracked."},"ready":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["total","ready","syncing","stuck"],"description":"Rollup of this project's pull-mode installations by operations-bundle sync status, reflecting the currently enabled plugin set."},"SetBuiltinOperationsPluginsResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["names","permissionDiff"]},"OperationsPermissionDiff":{"type":"object","properties":{"aws":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change adds."},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change removes from the generated cloud configuration."}},"required":["added","removed"]},"gcp":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}}},"required":["added","removed"]},"kubernetes":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}}},"required":["added","removed"]},"incompleteForPlugins":{"type":"array","items":{"type":"string"},"description":"Previously enabled plugins whose grants could not be read before this change disabled or replaced them. Added and removed grants may be incomplete; inspect existing cloud policies before applying the regenerated configuration."}},"required":["aws","gcp","kubernetes"],"description":"Cloud permission delta versus the previously enabled set."},"OperationsAwsPermissionDiffStatement":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["effect","actions","resources","condition","sources"]},"OperationsPermissionDiffSource":{"type":"object","properties":{"plugin":{"type":"string","description":"Plugin that declared the permission."},"operation":{"type":"string","description":"Operation that declared the permission."},"reason":{"type":"string","description":"Why the operation needs this permission."}},"required":["plugin","operation","reason"]},"OperationsGcpPermissionDiffGrant":{"type":"object","properties":{"permission":{"type":"string"},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"],"description":"Where setup grants the permission: the configured project, or each Cloud Storage bucket the installer lists."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["permission","scope","sources"]},"OperationsKubernetesPermissionDiffGrant":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Empty means every resource name."},"remediationOnly":{"type":"boolean","description":"True for write verbs. The Helm chart renders them only when Operator permission is set to remediation; diagnostics installs omit them."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["apiGroup","resource","verbs","resourceNames","remediationOnly","sources"]},"SetBuiltinOperationsPluginsRequest":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"},"description":"Complete set of built-in plugins to enable."}},"required":["names"],"additionalProperties":false},"OperationsBundleUploadUrlResponse":{"type":"object","properties":{"uploadUrl":{"type":"string","format":"uri","description":"Presigned S3 PUT URL to upload the bundle ZIP to."},"uploadId":{"type":"string","description":"One-time id for this upload. Pass it back verbatim to POST /plugins so the API can validate and snapshot exactly the bytes this call uploaded."},"contentType":{"type":"string","description":"Content-Type header the PUT must send (must match the signature)."}},"required":["uploadUrl","uploadId","contentType"]},"OperationsBundleUploadUrlRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."}},"required":["name"]},"PublishOperationsPluginResponse":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","version","tier","enabled","permissionDiff"]},"PublishOperationsPluginRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."},"version":{"type":"string","minLength":1,"description":"Plugin version."},"uploadId":{"type":"string","minLength":1,"description":"The uploadId returned by POST /plugins/upload-url for the ZIP just uploaded. Identifies the exact S3 object to publish — never derived from name/version, so it can't collide with any other upload."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default risk tier."},"metadata":{"type":"object","properties":{"name":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"default":"destructive"},"binaries":{"oneOf":[{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["amd64"],"additionalProperties":false},{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["arm64"],"additionalProperties":false}]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"description":{"type":"string","nullable":true,"minLength":1},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"paramsSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"permissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"requiredPermissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1,"maximum":4294967295},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string","minLength":1,"description":"Human-readable: what this operation changes."},"pollOperation":{"type":"string","minLength":1,"description":"A read-only operation in the same plugin to poll for success."},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string","minLength":1},"default":{},"description":"Poll operation param name -> field name in the write operation's own result."},"successField":{"type":"string","minLength":1,"description":"Dotted field path in the poll result that signals success."},"successValue":{"type":"string","minLength":1,"description":"The value at successField that means verified."},"retry":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"timeoutSeconds":{"type":"integer","minimum":1,"maximum":4294967295}},"required":["changes","pollOperation","successField","successValue","timeoutSeconds"],"additionalProperties":false},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string","minLength":1},"minItems":1}},"required":["kind","fields"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"],"additionalProperties":false}]},"kubernetesPermissions":{"$ref":"#/components/schemas/KubernetesPermissions"}},"required":["name","permissions"],"additionalProperties":false},"default":[]}},"required":["name","version","binaries"],"additionalProperties":false,"description":"The complete canonical metadata.json from the uploaded bundle."}},"required":["name","version","uploadId","tier","metadata"]},"KubernetesPermissions":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/Rule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false},"Rule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/Verb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"Verb":{"type":"string","enum":["get","list","watch","delete","patch"]},"SetOperationsPluginEnabledResponse":{"type":"object","properties":{"name":{"type":"string"},"builtin":{"type":"boolean"},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","builtin","enabled","permissionDiff"]},"SetOperationsPluginEnabledRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether the plugin is distributed to this project's Operators."},"dryRun":{"type":"boolean","description":"Validate the change and return its permission delta without saving it. Defaults to false."},"expectedPermissionDiff":{"allOf":[{"$ref":"#/components/schemas/OperationsPermissionDiff"},{"description":"The permission delta the caller reviewed, usually from a dry run. When set, the change is rejected with 409 if the current delta differs."}]}},"required":["enabled"]},"OperationsPolicyResponse":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"}},"default":{"type":"string","enum":["auto","manual"],"description":"Decision for commands no rule matches."}},"required":["rules","default"]},"OperationsPolicyRule":{"type":"object","properties":{"pattern":{"type":"string","description":"`plugin/operation`, `plugin/*`, or `*`."},"decision":{"type":"string","enum":["auto","manual"],"description":"auto: run immediately. manual: needs customer approval before running."},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself."}},"required":["pattern","decision"]},"UpdateOperationsPolicyRequest":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"},"description":"The full rule set (replaces the previous one)."}},"required":["rules"]},"InvokeOperationResponse":{"type":"object","properties":{"plugin":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"The operation's declared risk tier (informational)."},"decision":{"type":"string","enum":["auto","manual"],"description":"The approval decision the policy resolved to."},"status":{"type":"string","enum":["dispatched","pending-approval"],"description":"dispatched: auto-approved and running. pending-approval: needs customer sign-off."},"commandId":{"type":"string","description":"The created operation-command id when dispatched (absent when pending)."}},"required":["plugin","operation","tier","decision","status"]},"InvokeOperationRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment to run the operation against."},"plugin":{"type":"string","description":"Plugin name."},"operation":{"type":"string","description":"Operation name exposed by the plugin."},"params":{"nullable":true,"description":"JSON params passed to the operation."},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key used to deduplicate this exact target operation."},"remediationPlanId":{"type":"string","description":"A remediation plan (`plan_…`) whose access request the customer has already approved for this exact command. When set and the plan's access request was created by the caller, is `customer-approved` and lists this `plugin/operation` with these params, the invocation is authorized by that approval and dispatches immediately regardless of the project's operations policy — the customer already signed off on this exact command via the access-request flow, so the project's default `manual` policy (meant for ad-hoc, unreviewed invocations) would otherwise require a second, redundant approval for the same action. Another principal's approved request never authorizes the caller."},"accessRequestId":{"type":"string","description":"A CLI-originated access request (`accessRequest_…`, no remediation plan) the caller created and the customer has already approved covering this exact command — either an exact match or a resolved, frozen wildcard entry. Same bypass semantics as `remediationPlanId`, for requests with no investigation behind them. Set exactly one of `remediationPlanId` or `accessRequestId`, not both. With neither, any approved request the caller created covering this exact command is used."}},"required":["deploymentId","plugin","operation"]},"VerifyOperationCheckResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["verified","not-yet","failed","skipped"],"description":"verified: success condition met. not-yet: keep polling. failed: the poll operation itself reported failure. skipped: the operation has no verification spec, or the write result carries none of the fields verification needs (the caller never opted in for this invocation)."},"reason":{"type":"string","description":"Present for 'failed' and 'skipped'."},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer"},"intervalSeconds":{"type":"integer"}},"required":["maxAttempts","intervalSeconds"],"description":"The operation's declared retry policy, echoed so the caller's poll loop doesn't need its own copy."},"timeoutSeconds":{"type":"integer","description":"The operation's declared verification timeout."}},"required":["outcome"]},"VerifyOperationCheckRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment the original write command ran against."},"commandId":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Original operation command whose stored result and dispatch-time verification contract are authoritative.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"}},"required":["deploymentId","commandId"]},"AccessRequestDebugGrant":{"type":"object","nullable":true,"properties":{"tool":{"$ref":"#/components/schemas/DebugGrantTool"},"namespace":{"type":"string","example":"braintrust"},"cloudScope":{"type":"string","example":"123456789012/prod-readonly"}},"required":["tool"]},"DebugGrantTool":{"type":"string","enum":["kubectl","aws","gcloud","az"]},"AccessRequestStatus":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"CreateAccessRequest":{"type":"object","properties":{"replayKey":{"type":"string","minLength":1,"maxLength":128,"description":"Durable replay key scoped to the authenticated requester and workspace. Reusing it with a different validated payload returns ACCESS_REQUEST_REPLAY_MISMATCH."},"requestedExpiresAt":{"type":"string","format":"date-time","description":"Absolute requester deadline in UTC (Z suffix). Must be in the future and at most six hours ahead (30 seconds clock-skew tolerance). Approvals never extend it. Omit for legacy approval-window behavior."},"deploymentId":{"type":"string"},"remediationPlanId":{"type":"string","description":"Set for a plan-backed (ai-agent) request. Omit for a plan-less (CLI) request."},"title":{"type":"string","description":"Required for a plan-backed request; defaults to the operation/pattern/debug-tool for a plan-less one."},"reason":{"type":"string"},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]},"minItems":1,"description":"Plan-backed only: the exact commands the investigation is requesting."},"operation":{"type":"string","example":"kubernetes/restart-pod","description":"Plan-less, exact request: a single `plugin/operation`."},"operationPattern":{"type":"string","example":"kubernetes/*","description":"Plan-less, wildcard request: `plugin/*`. Requires `maxRisk`."},"params":{"nullable":true,"description":"Params for an exact `operation` request."},"maxRisk":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Required with `operationPattern`: the highest risk tier the wildcard grant may cover."},"debugTool":{"allOf":[{"$ref":"#/components/schemas/DebugGrantTool"},{"description":"Requests a remote-debugging grant for this tool, alongside or instead of an operations grant."}]},"debugNamespace":{"type":"string","example":"braintrust","description":"Scopes a `kubectl` debug grant to one Kubernetes namespace. Requires `debugTool: kubectl`."},"debugCloudScope":{"type":"string","example":"123456789012/prod-readonly","description":"Scopes an `aws`/`gcloud`/`az` debug grant to a customer-meaningful account/project/subscription string. Requires `debugTool` set to that provider."}},"required":["deploymentId"]},"AccessRequestApprovalMethod":{"type":"string","example":"slack"},"AccessRequestActivity":{"type":"object","properties":{"operations":{"type":"array","items":{"type":"object","properties":{"commandId":{"type":"string"},"invocationId":{"type":"string","nullable":true,"description":"The MCP invocation that dispatched the command, when MCP did."},"command":{"type":"string","description":"`plugin/operation`."},"state":{"type":"string"},"createdAt":{"type":"string"},"dispatchedAt":{"type":"string","nullable":true},"completedAt":{"type":"string","nullable":true},"verification":{"$ref":"#/components/schemas/CommandVerification"}},"required":["commandId","invocationId","command","state","createdAt","dispatchedAt","completedAt","verification"]}},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"state":{"$ref":"#/components/schemas/DebugSessionState"},"owner":{"type":"string","nullable":true},"createdAt":{"type":"string"},"expiresAt":{"type":"string"}},"required":["id","state","owner","createdAt","expiresAt"]}}},"required":["operations","debugSessions"]},"RevokeAccessRequest":{"type":"object","properties":{"reason":{"type":"string","maxLength":4096,"description":"Why the grant is withdrawn, for the audit trail."}}},"SyncListResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"userEnvironmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"deploymentToken":{"type":"string","nullable":true},"lockedBy":{"type":"string","nullable":true},"lockedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId","userEnvironmentVariables"]}}},"required":["deployments"],"description":"Full deployment records for manager operation"},"SyncListRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. Manager-scoped tokens are always constrained to their own manager ID."}]},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to include"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment status"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by deployment platform"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Filter by deployment group ID","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"limit":{"type":"integer","minimum":1,"maximum":500,"description":"Maximum records to return"}},"additionalProperties":false,"description":"Request to list full operational deployments"},"SyncAcquireResponseDeployment":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Deployment group ID the deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method recorded on the deployment when it has a setup-owned path."}]},"operationId":{"type":"string","nullable":true,"pattern":"duop_[0-9a-z]{28}$","description":"Immutable target claimed for this execution, or null for observation-only work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","nullable":true,"pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed by this manager session, or null for observation-only work.","example":"duat_uve04tou5eoua3q17dar1pz"},"current":{"$ref":"#/components/schemas/DeploymentState"},"config":{"$ref":"#/components/schemas/DeploymentConfig"}},"required":["deploymentId","projectId","deploymentGroupId","operationId","attemptId","current","config"]},"DeploymentState":{"type":"object","properties":{"currentRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}]},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"protocolVersion":{"type":"integer","minimum":0,"description":"Protocol version for cross-actor compatibility.\nAll actors (manager, push client, agent) check this before stepping.\nMismatched versions produce a clear error instead of silent corruption.\nSee docs/02-manager/10-deployment-protocol.md."},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment\nWhen true and status is a failed state, the deployment system will retry failed resources"},"runtimeMetadata":{"oneOf":[{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},{"nullable":true}]},"stackState":{"oneOf":[{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},{"nullable":true}]},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"targetRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]}},"required":["platform","protocolVersion","status"],"description":"Current deployment state (includes releases)"},"DeploymentConfig":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["environmentVariables"],"description":"Deployment configuration"},"SyncContextRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the context. Manager-scoped tokens are constrained to their own manager ID."}]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false},"SyncAcquireResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"},"description":"List of acquired deployments with deployment context"},"failures":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment that failed","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"error":{"allOf":[{"$ref":"#/components/schemas/APIError"},{"description":"Error that occurred during context building"}]}},"required":["deploymentId","projectId","error"]},"description":"List of deployments that failed during context building (locks already released)"},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time","description":"When the provisional leases on the returned deployments lapse. Confirm them with sync/renew before starting work. Null when nothing was acquired."}},"required":["deployments","failures","leaseExpiresAt"],"description":"Acquired deployments and failures"},"SyncAcquireRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. If omitted, resolved from each deployment's managerId column."}]},"session":{"type":"string","description":"Unique session identifier for lock tracking"},"requestId":{"type":"string","minLength":1,"description":"Idempotency key for one logical acquire request"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to lock (for Pull model sync)"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment statuses (default: all deployment statuses)"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by platforms (default: all platforms the Manager supports)"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Filter by setup method for setup-owned acquisition paths"}]},"acquireMode":{"type":"string","enum":["runtime","setup-run","setup-teardown"],"description":"Phase ownership mode for deployment acquisition"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model from stackSettings.deploymentModel."},"supportsExecutionClaims":{"type":"boolean","enum":[true],"description":"Signals support for echoing executionClaim on renew, reconcile, and release."},"limit":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of deployments to acquire (default: 10)"}},"required":["session","requestId","deploymentModel"],"additionalProperties":false,"description":"Request to acquire deployments for processing"},"SyncReconcileResponse":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the state was reconciled"},"current":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Current deployment state after reconciliation"}]},"target":{"$ref":"#/components/schemas/TargetDeployment"},"targetOperationsBundleSet":{"$ref":"#/components/schemas/TargetOperationsBundleSet"},"targetDynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"deleted":{"type":"boolean"},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]},"suspendedReason":{"type":"string","maxLength":512}},"required":["name","generation","image","cpu","memory","replicas","ports","deleted","env","secretEnv"]},"description":"Complete release-independent dynamic container target set for a Kubernetes Operator."}},"required":["success","current"],"description":"State reconciliation result with optional target"},"TargetDeployment":{"type":"object","properties":{"config":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["environmentVariables"],"description":"Deployment configuration\n\nConfiguration for how to perform the deployment.\nNote: Credentials (ClientConfig) are passed separately to step() function."},"releaseInfo":{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."}},"required":["config","releaseInfo"],"description":"Target deployment if update is needed"},"TargetOperationsBundleSet":{"type":"object","properties":{"hash":{"type":"string","minLength":1,"maxLength":256},"bundles":{"type":"array","items":{"$ref":"#/components/schemas/OperationsBundleDownload"}}},"required":["hash","bundles"],"description":"Target operations-bundle set the Operator should converge its loaded plugin registry toward."},"OperationsBundleDownload":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"url":{"type":"string","format":"uri","description":"Presigned URL to GET the bundle ZIP from. Short-lived."}},"required":["plugin","pluginVersion","url"]},"SyncReconcileRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to reconcile state for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Lock session (push model only) - verifies lock ownership"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Immutable operation claimed at acquisition. Required with attemptId for update execution.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed at acquisition. Required with operationId for update execution.","example":"duat_uve04tou5eoua3q17dar1pz"},"state":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Complete deployment state after step() execution"}]},"updateHeartbeat":{"type":"boolean","description":"Update heartbeat timestamp (for successful health checks)"},"suggestedDelayMs":{"type":"integer","minimum":0,"description":"Delay before this deployment should be acquired again."},"resourceHeartbeats":{"type":"array","items":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"description":"Latest typed resource heartbeats collected during this step."},"observedInventoryBatches":{"type":"array","items":{"$ref":"#/components/schemas/ObservedInventoryBatch"},"description":"Observed raw-resource inventory batches read during this step."},"capabilities":{"type":"array","items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Operator-reported runtime capabilities."},"operatorVersion":{"type":"string","minLength":1,"maxLength":128,"description":"Operator binary version reported by the runtime."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorImageIdentity"},"operationsReport":{"$ref":"#/components/schemas/OperationsReport"},"dynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"message":{"type":"string","maxLength":2048}},"required":["name","generation","status"]},"description":"Observed dynamic container generations from a Kubernetes Operator."}},"required":["deploymentId","state"],"additionalProperties":false,"description":"Request to reconcile deployment state"},"ObservedInventoryBatch":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"],"description":"Backend whose observer produced this snapshot."},"complete":{"type":"boolean","description":"Whether this batch is a complete replacement for the scope. Complete\nbatches tombstone previously observed rows in the same scope when they\nare absent from `resources`."},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inventoryScope":{"type":"string","description":"Stable scope for the provider list operation that produced this batch."},"observedAt":{"type":"string","format":"date-time","description":"Time the inventory scope was observed."},"resources":{"type":"array","items":{"type":"object","properties":{"alienResourceId":{"type":"string","nullable":true},"attributes":{"type":"object","properties":{},"additionalProperties":{"nullable":true}},"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"counts":{"oneOf":[{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},{"nullable":true}]},"deploymentId":{"type":"string","nullable":true},"displayName":{"type":"string"},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"images":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."},"description":"Distinct container images the resource's running instances report, when\nthe provider exposes them."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerKind":{"type":"string","description":"Provider-native kind, such as `apps/v1/Deployment`,\n`AWS::S3::Bucket`, `storage.googleapis.com/Bucket`, or an Azure\nresource type."},"providerStale":{"type":"boolean"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"rawIdentity":{"type":"string","description":"Provider-native stable identity: Kubernetes object identity, cloud ARN,\nGCP full resource name, Azure resource id, etc."},"region":{"type":"string","nullable":true},"resourceTypeHint":{"oneOf":[{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},{"nullable":true}]},"scope":{"type":"string","nullable":true},"version":{"type":"string","nullable":true,"description":"Release/version identity observed from the provider resource, when available."}},"required":["displayName","health","lifecycle","partial","providerKind","providerStale","rawIdentity"]}},"sourceKind":{"type":"string","description":"Writer/source for this inventory pass, such as `operator` or\n`manager-observer`."}},"required":["backend","complete","controllerPlatform","inventoryScope","observedAt","resources","sourceKind"]},"RemoteOperatorImageIdentity":{"type":"object","properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"}},"required":["source","packageId","packageVersion","image","digest"],"additionalProperties":false,"description":"Immutable installer receipt self-reported by a running Remote Operator. This is not independent runtime image inspection."},"OperationsReport":{"type":"object","properties":{"loadedBundleHash":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"operations":{"type":"array","items":{"$ref":"#/components/schemas/ReportedOperation"},"default":[]}},"description":"Operations bundle set the Operator currently has loaded, for plugin-sync status tracking."},"SyncRenewRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Single deployment to renew. Deprecated: use deploymentIds. Retained so a manager built against the previous API keeps renewing during rollout.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"minItems":1,"maxItems":100,"description":"Deployments to renew or confirm. Renewal is per deployment: the response reports each one independently."},"claims":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Unique identifier for the deployment update attempt.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","operationId","attemptId"]},"maxItems":100,"description":"Claim identities for deployments currently executing an update."},"session":{"type":"string","minLength":1}},"required":["session"],"additionalProperties":false},"SyncReleaseRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to release","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Session identifier to release"},"mode":{"type":"string","enum":["release","acknowledge-completed"],"description":"Defaults to release. acknowledge-completed discards an exact terminal pull receipt after a lost response; it never releases newer work or grants a live lease."},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Operation returned by acquire. Required when the lease carried update work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Attempt returned by acquire. Required when the lease carried update work.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","session"],"additionalProperties":false,"description":"Request to release deployment lock"},"ResolveResponse":{"type":"object","properties":{"managerId":{"type":"string","description":"Manager ID"},"managerName":{"type":"string","description":"Manager display name"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL"},"managerIsSystem":{"type":"boolean","description":"Whether the manager is Alien-hosted"},"managerCloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where the private manager is hosted. Null for Alien-hosted managers."},"projectId":{"type":"string","description":"Resolved project ID"},"installContext":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}},"required":["platform","managementConfig"],"description":"Target install context derived from platform-managed manager metadata. Present for cloud push platforms."}},"required":["managerId","managerName","managerUrl","managerIsSystem","projectId"]},"CloudRegionsResponse":{"type":"object","properties":{"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"}},"required":["supportedRegions"]},"BillingAuditLogRow":{"type":"object","properties":{"id":{"type":"string"},"workspaceId":{"type":"string","nullable":true},"action":{"type":"string"},"payload":{"nullable":true},"createdAt":{"type":"string"}},"required":["id","workspaceId","action","createdAt"]},"WorkspaceBillingEntitlements":{"type":"object","properties":{"planId":{"$ref":"#/components/schemas/PlanId"},"planStatus":{"$ref":"#/components/schemas/BillingPlanStatus"},"features":{"$ref":"#/components/schemas/BillingFeatureFlags"},"limits":{"$ref":"#/components/schemas/BillingLimits"},"syncedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"}},"required":["planId","planStatus","features","limits","syncedAt","stale"]},"PlanId":{"type":"string","enum":["starter","pro","pro_annual","enterprise"]},"BillingPlanStatus":{"type":"string","enum":["active","trialing","past_due","canceled","none"]},"BillingFeatureFlags":{"type":"object","properties":{"custom_domains":{"type":"boolean"},"private_managers":{"type":"boolean"},"operations_custom_plugins":{"type":"boolean"},"sso_saml":{"type":"boolean"},"audit_logs":{"type":"boolean"},"airgapped":{"type":"boolean"}},"required":["custom_domains","private_managers","operations_custom_plugins","sso_saml","audit_logs","airgapped"]},"BillingLimits":{"type":"object","properties":{"maxDeployments":{"type":"number","nullable":true},"maxProjects":{"type":"number","nullable":true},"maxSeats":{"type":"number","nullable":true},"maxCustomDomains":{"type":"number","nullable":true},"creditUsd":{"type":"number","nullable":true},"seatsIncluded":{"type":"number","nullable":true}},"required":["maxDeployments","maxProjects","maxSeats","maxCustomDomains","creditUsd","seatsIncluded"]},"WorkspaceGatewayOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"summary":{"type":"object","properties":{"totalProjects":{"type":"integer","minimum":0},"gatewayProjects":{"type":"integer","minimum":0},"activeProjects":{"type":"integer","minimum":0},"setupInProgressProjects":{"type":"integer","minimum":0},"needsAttentionProjects":{"type":"integer","minimum":0},"connectedCustomers":{"type":"integer","minimum":0}},"required":["totalProjects","gatewayProjects","activeProjects","setupInProgressProjects","needsAttentionProjects","connectedCustomers"]},"projects":{"type":"array","items":{"$ref":"#/components/schemas/GatewayProjectOverview"}}},"required":["generatedAt","summary","projects"]},"GatewayProjectOverview":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"state":{"$ref":"#/components/schemas/GatewayProjectState"},"connectedCustomers":{"type":"integer","minimum":0},"settingUpCustomers":{"type":"integer","minimum":0},"needsAttentionCustomers":{"type":"integer","minimum":0},"revokedCustomers":{"type":"integer","minimum":0}},"required":["id","name","state","connectedCustomers","settingUpCustomers","needsAttentionCustomers","revokedCustomers"]},"GatewayProjectState":{"type":"string","enum":["not-set-up","setup-in-progress","active","needs-attention"]},"GatewayKind":{"type":"string","enum":["ai","encryption","sandbox"],"description":"Alien Gateway a customer deployment runs","example":"ai"}},"parameters":{}},"paths":{"/v1/invitations/{token}":{"get":{"operationId":"getWorkspaceInvitationPreview","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation preview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitationPreview"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/memberships":{"get":{"operationId":"listMemberships","description":"List all workspaces the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listMemberships","responses":{"200":{"description":"List of user's workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Membership"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile":{"get":{"operationId":"getUserProfile","description":"Get the current user's profile and user-scoped onboarding state.","x-speakeasy-group":"user","x-speakeasy-name-override":"getProfile","responses":{"200":{"description":"User profile.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateUserProfile","description":"Update the current user's profile (display name).","x-speakeasy-group":"user","x-speakeasy-name-override":"updateProfile","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"}}}}}},"responses":{"200":{"description":"Profile updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile/setup":{"post":{"operationId":"completeUserProfileSetup","description":"Complete the required beta intake and profile setup dialog.","x-speakeasy-group":"user","x-speakeasy-name-override":"completeProfileSetup","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfileSetupRequest"}}}},"responses":{"200":{"description":"Profile setup completed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/workspaces":{"post":{"operationId":"createWorkspace","description":"Create a new workspace. The current user will be automatically added as an admin.","x-speakeasy-group":"user","x-speakeasy-name-override":"createWorkspace","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name"},"logoUrl":{"type":"string","format":"uri","description":"Optional workspace logo URL"}},"required":["name"]}}}},"responses":{"201":{"description":"Created workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Membership"}}}},"400":{"description":"Bad request - invalid workspace name.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Workspace name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces":{"get":{"operationId":"listGitNamespaces","description":"List all git namespaces (GitHub installations) the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaces","parameters":[{"schema":{"type":"string","enum":["github"],"default":"github"},"required":false,"name":"provider","in":"query"}],"responses":{"200":{"description":"List of user's git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/sync":{"post":{"operationId":"syncGitNamespaces","description":"Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.","x-speakeasy-group":"user","x-speakeasy-name-override":"syncGitNamespaces","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github"],"description":"Git provider to sync"}},"required":["provider"]}}}},"responses":{"200":{"description":"Synced git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/{id}/repositories":{"get":{"operationId":"listGitNamespaceRepositories","description":"List repositories accessible through a git namespace (GitHub installation).","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaceRepositories","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","description":"Search query to filter repositories by name"},"required":false,"description":"Search query to filter repositories by name","name":"search","in":"query"}],"responses":{"200":{"description":"List of repositories.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitRepository"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Git namespace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/pending":{"get":{"operationId":"getPendingWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"required":true,"name":"workspace","in":"query"}],"responses":{"200":{"description":"An active invitation addressed to the signed-in user for this workspace, if any.","content":{"application/json":{"schema":{"type":"object","properties":{"invitationId":{"type":"string","nullable":true,"pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"}},"required":["invitationId"]}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/{token}/accept":{"post":{"operationId":"acceptWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptWorkspaceInvitationResponse"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/whoami":{"get":{"operationId":"whoami","description":"Get the current authenticated principal (user or service account). Works with both session cookies and API keys.","x-speakeasy-group":"auth","x-speakeasy-name-override":"whoami","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","example":"my-workspace"},"required":false,"description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current authenticated principal.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Subject"}}}},"400":{"description":"Missing required workspace for user credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export":{"get":{"operationId":"getProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Configuration and delivery status; headers are never returned.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string","maxLength":2048,"format":"uri"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}}},"required":["endpoint","enabled"]}}}},"responses":{"200":{"description":"Saved configuration. Changes take effect within 30 seconds.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export/test":{"post":{"operationId":"testProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Result of sending one test log to the saved destination.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}":{"get":{"operationId":"getLogExportDeliveryConfig","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"responses":{"200":{"description":"Private runtime configuration for the assigned manager.","content":{"application/json":{"schema":{"type":"object","nullable":true,"properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}},"revision":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}},"required":["endpoint","enabled","headers","revision","updatedAt"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}/status":{"post":{"operationId":"reportLogExportDelivery","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"revision":{"type":"string"},"succeeded":{"type":"boolean"},"error":{"type":"string","nullable":true,"enum":["timeout","connection","destination-rejected","invalid-destination","overflow",null]},"statusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599}},"required":["revision","succeeded","error"]}}}},"responses":{"200":{"description":"Delivery status recorded for the current configuration revision.","content":{"application/json":{"schema":{"type":"object","properties":{"accepted":{"type":"boolean"}},"required":["accepted"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces":{"get":{"operationId":"listWorkspaces","description":"Retrieve all workspaces.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search workspaces by name"},"required":false,"description":"Search workspaces by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Workspace"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}":{"get":{"operationId":"getWorkspace","description":"Retrieve a workspace by ID.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspace","description":"Update a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"}}}}}},"responses":{"200":{"description":"Workspace updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteWorkspace","description":"Delete a workspace. The workspace must have no projects.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Workspace deleted successfully."},"400":{"description":"Workspace still has projects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members":{"get":{"operationId":"listWorkspaceMembers","description":"List all members of a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"listMembers","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"List of workspace members.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceMember"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"addWorkspaceMember","description":"Add a member to a workspace by email. The user must already have an account.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"addMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email","description":"Email of the user to add"},"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"Role to assign"}]}},"required":["email","role"]}}}},"responses":{"201":{"description":"Member added successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"404":{"description":"Workspace or user not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"User is already a member.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members/{userId}":{"patch":{"operationId":"updateWorkspaceMember","description":"Update a workspace member's role.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"New role to assign"}]}},"required":["role"]}}}},"responses":{"200":{"description":"Member role updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"400":{"description":"Cannot remove last admin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"removeWorkspaceMember","description":"Remove a member from a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"removeMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Member removed successfully."},"400":{"description":"Cannot remove last admin or self.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/settings":{"get":{"operationId":"getWorkspaceSettings","description":"Read the ai-agent settings for a workspace. Returns defaults (`enabled: true`) when the workspace has never customized them.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"getSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspaceSettings","description":"Update the ai-agent settings for a workspace. Supports `enabled` (`false` turns the ai-agent off so incoming triggers are rejected before any session runs).","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkspaceSettingsRequest"}}}},"responses":{"200":{"description":"Updated ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations":{"get":{"operationId":"listWorkspaceInvitations","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Pending invitations.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceInvitation"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["email","role"]}}}},"responses":{"201":{"description":"Invitation created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"403":{"description":"Seat limit reached.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}/resend":{"post":{"operationId":"resendWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Invitation email sent again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}":{"delete":{"operationId":"revokeWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invitation revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invite-link":{"get":{"operationId":"getWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Active invite link.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"createWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["role"]}}}},"responses":{"200":{"description":"Invite link created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invite link revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects":{"get":{"operationId":"listProjects","description":"Retrieve all projects.","x-speakeasy-group":"projects","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search projects by name"},"required":false,"description":"Search projects by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deploymentCount","latestRelease"]},"description":"Optional fields to include: deploymentCount, latestRelease"},"required":false,"description":"Optional fields to include: deploymentCount, latestRelease","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved projects.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createProject","description":"Create a new project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"enabledCapabilities":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"minItems":1,"maxItems":5}},"required":["name"]}}}},"responses":{"201":{"description":"Project created successfully.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"}}}]}}}},"400":{"description":"Invalid request or GitHub repository connection failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}":{"get":{"operationId":"getProject","description":"Retrieve a project by ID or name.","x-speakeasy-group":"projects","x-speakeasy-name-override":"get","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateProject","description":"Update a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"update","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProject"}}}},"responses":{"200":{"description":"Project updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"403":{"description":"Project update permission is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this project's release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request or package settings are invalid or incomplete.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteProject","description":"Delete a project. The project must have no deployments.","x-speakeasy-group":"projects","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Project deleted successfully."},"400":{"description":"Project still has deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/gcp-oauth-provider":{"get":{"operationId":"getProjectGcpOAuthProvider","description":"Retrieve redacted project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectGcpOAuthProvider","description":"Update project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"updateGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProjectGcpOAuthProvider"}}}},"responses":{"200":{"description":"Google Cloud OAuth provider settings updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"400":{"description":"Invalid provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/source":{"post":{"operationId":"configureProjectSource","description":"Connect a GitHub repository or Alien template to an existing project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureSource","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["repository"]},"gitRepository":{"type":"object","properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","gitRepository"]},{"type":"object","properties":{"mode":{"type":"string","enum":["template"]},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","targetNamespace","templatePath"]}]}}}},"responses":{"200":{"description":"Project source connected.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}}}]}}}},"400":{"description":"Repository or template configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Template fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-portal-domain":{"get":{"operationId":"getProjectDeploymentPortalDomain","description":"Get the deployment portal domain binding for a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentPortalDomain","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment portal domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentPortalDomainResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/import-template":{"post":{"operationId":"createProjectFromTemplate","description":"Create a project by forking alienplatform/alien into your namespace.","x-speakeasy-group":"projects","x-speakeasy-name-override":"createFromTemplate","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$","description":"GitHub owner namespace (user or organization) that will receive the fork"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"}},"required":["name","targetNamespace","templatePath"]}}}},"responses":{"201":{"description":"Project created successfully from template.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}},"required":["template"]}]}}}},"400":{"description":"Bad request or GitHub integration not installed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/template-urls":{"get":{"operationId":"getProjectTemplateUrls","description":"Get template URLs for deploying setup stacks in this project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getTemplateUrls","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Template URLs retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"aws":{"type":"object","nullable":true,"properties":{"templateUrl":{"type":"string","format":"uri","description":"URL to download the CloudFormation template"},"launchStackUrl":{"type":"string","format":"uri","description":"URL to launch the template in the AWS CloudFormation console"}},"required":["templateUrl","launchStackUrl"],"description":"Template URLs for deploying an AWS setup stack"}}}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-link-setup":{"get":{"operationId":"getProjectDeploymentLinkSetup","description":"Get the active release stack and portal-visible setup availability for deployment-link configuration.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentLinkSetup","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment-link setup retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentLinkSetupResponse"}}}},"400":{"description":"The project's sandbox follows an Alien default image this environment does not configure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or active release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/active-release":{"get":{"operationId":"getProjectActiveRelease","description":"Get the production channel's current release. When deploymentId is provided, returns that deployment's effective release: its pin, or its followed channel's current release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getActiveRelease","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Optional deployment ID to check for pinned release"},"required":false,"description":"Optional deployment ID to check for pinned release","name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Effective release retrieved successfully.","content":{"application/json":{"schema":{"nullable":true}}}},"404":{"description":"Project or effective release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models/impact":{"post":{"operationId":"previewProjectModelsImpact","description":"Preview which customer model connections a configuration change may affect.","x-speakeasy-group":"projects","x-speakeasy-name-override":"previewModelsImpact","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Model configuration impact.","content":{"application/json":{"schema":{"type":"object","properties":{"connectedCustomers":{"type":"integer","minimum":0},"affectedCustomers":{"type":"integer","minimum":0},"verificationNeeded":{"type":"integer","minimum":0},"affected":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"provider":{"type":"string"},"reason":{"type":"string","enum":["provider-no-longer-compatible","required-model-not-in-catalog"]}},"required":["deploymentGroupId","name","externalId","provider","reason"]}},"truncated":{"type":"boolean"}},"required":["connectedCustomers","affectedCustomers","verificationNeeded","affected","truncated"]}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities":{"put":{"operationId":"setProjectCapabilities","description":"Set the capabilities offered by a Project. Removing a capability prevents new setup without deleting existing customer resources.","x-speakeasy-group":"projects","x-speakeasy-name-override":"setCapabilities","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"maxItems":5}},"required":["enabled"],"additionalProperties":false}}}},"responses":{"200":{"description":"The Project's enabled capabilities.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/deployments":{"put":{"operationId":"configureProjectDeployments","description":"Enable deployments for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureDeployments","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled","methods"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployments enabled for the Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-provider-headers":{"get":{"operationId":"getProjectAiProviderHeaders","description":"Get static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Static AI provider headers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"configureProjectAiProviderHeaders","description":"Replace the static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"responses":{"200":{"description":"Static AI provider headers updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"400":{"description":"Provider header configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models":{"put":{"operationId":"configureProjectModels","description":"Configure customer-owned model providers without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureModels","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Customer Models configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/keys":{"put":{"operationId":"configureProjectKeys","description":"Enable customer-owned application encryption without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["applicationEncryption"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Key configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/buckets":{"put":{"operationId":"configureProjectBuckets","description":"Enable buckets without requiring a project Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureBuckets","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"access":{"type":"string","enum":["read-write"]}},"required":["access"],"additionalProperties":false}}}},"responses":{"200":{"description":"Buckets configured and their exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/registry":{"put":{"operationId":"configureProjectRegistry","description":"Enable customer-owned container registries without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRegistry","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["repositories","credentialPolicy"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Registry configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox":{"put":{"operationId":"configureProjectRemoteSandbox","description":"Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRemoteSandbox","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureRemoteSandboxRequest"}}}},"responses":{"200":{"description":"Sandbox configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"400":{"description":"The sandbox configuration cannot be satisfied by this environment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The request body is invalid, including a per-cloud field.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The image's registry or Alien's GCP image service could not be reached, or the save's GCP image could not be queued; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox/base-image-repository":{"post":{"operationId":"ensureProjectSandboxBaseImageRepository","description":"Ensure the project's private image repository exists and return where to push a private sandbox base image. Name the pushed image as the remote sandbox base image afterwards.","x-speakeasy-group":"projects","x-speakeasy-name-override":"ensureSandboxBaseImageRepository","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Repository ready to receive a push.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SandboxBaseImageRepository"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found, or no AWS manager serves it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager could not prepare the repository.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The project's manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/overview":{"get":{"operationId":"getProjectCapabilityOverview","description":"Get safe, server-derived capability status for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getCapabilityOverview","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Project capability overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilityOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-bindings/access":{"post":{"operationId":"createRemoteBindingsExternalAccess","tags":["remote-bindings"],"summary":"Create short-lived Remote Bindings access for a external resource","description":"Selects a connected external resource by Project and external ID, then returns a short-lived deployment-scoped Manager capability. The caller never receives the external cloud credentials from Platform.","x-speakeasy-group":"remoteBindings","x-speakeasy-name-override":"createExternalAccess","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessRequest"}}}},"responses":{"200":{"description":"Short-lived Remote Bindings access was created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessResponse"}}}},"401":{"description":"The API key is missing, invalid, expired, or disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot access Remote Bindings for this Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The Project or external ID was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"More than one active external resource matched.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The external resource or its assigned Manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary":{"get":{"operationId":"getRemoteOperatorProjectSummary","tags":["projects"],"summary":"Get the authoritative Remote Operator project summary","x-speakeasy-group":"projects","x-speakeasy-name-override":"getRemoteOperatorSummary","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Authoritative Remote Operator state composed from existing owners.","content":{"application/json":{"schema":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"nextAction":{"type":"object","properties":{"kind":{"type":"string","enum":["connect","inspect","reconnect","verify","update","wait","none"]},"target":{"type":"string","enum":["setup","deployment","releases","access","operations","activity"]},"deploymentId":{"type":"string","nullable":true},"message":{"type":"string"}},"required":["kind","target","deploymentId","message"]},"installations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroupId":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs","unknown"]},"region":{"type":"string","nullable":true},"state":{"type":"string","enum":["unhealthy","stale","connecting","unverified","verified"]},"stateReason":{"type":"string"},"status":{"type":"string"},"lastHeartbeatAt":{"type":"string","nullable":true,"format":"date-time"},"lastSuccessfulDiagnosticAt":{"type":"string","nullable":true,"format":"date-time"},"operatorVersion":{"type":"string","nullable":true},"operatorScope":{"type":"string","nullable":true},"operatorPermission":{"type":"string","nullable":true},"expectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"previousExpectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"runningImage":{"$ref":"#/components/schemas/ObservedRemoteOperatorImageIdentity"},"imageStatus":{"type":"string","enum":["matching","drifted","unreported","unconfigured"]},"operatorUpdate":{"type":"object","nullable":true,"properties":{"packageId":{"type":"string"},"packageVersion":{"type":"string"},"image":{"type":"string"},"digest":{"type":"string"},"builtAt":{"type":"string","format":"date-time"}},"required":["packageId","packageVersion","image","digest","builtAt"],"description":"The ready Operator image selected by the project's current configuration when it differs from the image this installation was set up with. Re-applying setup installs it. Null when the installation already uses it, its install identity is unknown, or the selected package is not ready."},"operationSync":{"type":"object","nullable":true,"properties":{"status":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"string","nullable":true}},"required":["status","targetBundleHash","observedBundleHash","targetSetAt","observedAt","error"]},"application":{"type":"object","properties":{"state":{"type":"string","enum":["no-desired","up-to-date","update-required","unknown","failed"],"description":"How the application release the Operator reports compares with the desired release. Alien never applies the change; the customer applies it through their own release process."},"reason":{"type":"string"},"reported":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The application release the Operator reports"},"desired":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["channel","pin"]},"helmChart":{"type":"object","nullable":true,"properties":{"chart":{"type":"string"},"version":{"type":"string"}},"required":["chart","version"],"description":"The Helm chart built for this release, when the release has one"},"images":{"type":"array","items":{"type":"string"},"description":"Container images the release records for AWS, in resource order"}},"required":["releaseId","version","source","helmChart","images"],"description":"The release the deployment should run: its pinned release or its channel's release"},"releaseChannel":{"type":"string","description":"The release channel the deployment follows when unpinned"},"rollback":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The release the deployment reported before it moved to the desired release"}},"required":["state","reason","reported","desired","releaseChannel","rollback"]},"permissions":{"type":"object","properties":{"status":{"type":"string","enum":["current","outdated","unknown"],"description":"Whether the Kubernetes RBAC and cloud IAM recorded for this installation match the permissions compiled from the currently enabled operations."},"recordedAt":{"type":"string","nullable":true,"format":"date-time","description":"When setup was issued or last re-applied; null when nothing was recorded."},"reason":{"type":"string"}},"required":["status","recordedAt","reason"],"description":"Installed cloud and Kubernetes permissions. Setup applies them, so enabling or disabling operations changes them only after the installation's setup is re-applied."}},"required":["id","name","deploymentGroupId","platform","region","state","stateReason","status","lastHeartbeatAt","lastSuccessfulDiagnosticAt","operatorVersion","operatorScope","operatorPermission","expectedImage","previousExpectedImage","runningImage","imageStatus","operatorUpdate","operationSync","application","permissions"]}},"unregisteredSetups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs"]},"createdAt":{"type":"string","format":"date-time"},"valuesExpireAt":{"type":"string","nullable":true,"format":"date-time","description":"When the newest installation values stop working. Resuming setup can replace them."}},"required":["deploymentGroupId","name","platform","createdAt","valuesExpireAt"]},"description":"Setups whose installation values were created but whose Operator never registered, newest first."}},"required":["items","unregisteredSetups"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"release":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"reported":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"deployments":{"type":"integer","minimum":0,"exclusiveMinimum":true},"latest":{"type":"boolean"}},"required":["releaseId","version","createdAt","deployments","latest"]},"description":"Application releases that Remote Operator deployments report, newest first. The newest reported release is latest."},"older":{"type":"integer","minimum":0,"description":"Deployments without a desired release that report a release older than the latest reported release"},"unknown":{"type":"integer","minimum":0,"description":"Deployments that report no application release"},"rollout":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"upToDate":{"type":"integer","minimum":0},"waiting":{"type":"integer","minimum":0},"unknown":{"type":"integer","minimum":0},"failed":{"type":"integer","minimum":0}},"required":["releaseId","version","upToDate","waiting","unknown","failed"]},"description":"Desired releases, most deployments first, with how many Remote Operator deployments run each one, still need the change, report no release, or failed after it"}},"required":["reported","older","unknown","rollout"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"access":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"pending":{"type":"integer","minimum":0},"active":{"type":"integer","minimum":0},"recent":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"approvedUntil":{"type":"string","nullable":true,"format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","title","status","approvedUntil","updatedAt"]}}},"required":["pending","active","recent"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"operations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"selected":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["builtin","custom"]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]}},"required":["name","tier"]}}},"required":["name","version","source","operations"]}},"sync":{"type":"object","properties":{"preparing":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"ready":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["preparing","syncing","ready","stuck"]},"generatedPermissions":{"type":"array","items":{"type":"object","properties":{"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]},"cloud":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetes":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["plugin","pluginVersion","operation","tier","cloud"]}}},"required":["selected","sync","generatedPermissions"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"activity":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"recent":{"type":"array","items":{"type":"object","properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string","nullable":true},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","nullable":true},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt"]}},"investigations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"deploymentId":{"type":"string"},"status":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","triggerType","deploymentId","status","createdAt","updatedAt"]},"description":"Recent agent sessions about Remote Operator deployments or their access requests"},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"state":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","state","createdAt","expiresAt"]}},"lastVerifiedOperation":{"type":"object","nullable":true,"properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string"},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","enum":["SUCCEEDED"]},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verification":{"type":"object","properties":{"state":{"type":"string","enum":["not-required","verified","skipped"]},"attempts":{"type":"integer","minimum":0},"maxAttempts":{"type":"integer","minimum":0},"deadline":{"type":"string","nullable":true,"format":"date-time"},"reason":{"type":"string","nullable":true}},"required":["state","attempts","maxAttempts","deadline","reason"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"resultAvailable":{"type":"boolean"},"result":{"nullable":true},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt","verification","sensitiveOutput","resultAvailable","completedAt"]}},"required":["recent","investigations","debugSessions","lastVerifiedOperation"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]}},"required":["generatedAt","project","nextAction","installations","release","access","operations","activity"]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-image":{"post":{"operationId":"acceptRemoteOperatorImage","tags":["projects"],"summary":"Accept a reported image for a Remote Operator installation","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorImage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"responses":{"200":{"description":"The observed immutable image is now the accepted desired image.","content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"400":{"description":"The deployment is not a Remote Operator installation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The requested image is not the image in the latest Operator heartbeat.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-permissions":{"post":{"operationId":"acceptRemoteOperatorPermissions","tags":["projects"],"summary":"Record that a Remote Operator installation's setup was re-applied","description":"Records the permissions compiled from the currently enabled operations as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorPermissions","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"reviewedPermissions":{"type":"array","items":{"$ref":"#/components/schemas/RemoteOperatorPermissionPlugin"},"description":"The enabled operations' permission declarations that the owner reviewed and re-applied."}},"required":["reviewedPermissions"]}}}},"responses":{"200":{"description":"The current permissions are recorded as installed.","content":{"application/json":{"schema":{"type":"object","properties":{"recordedAt":{"type":"string","format":"date-time"}},"required":["recordedAt"]}}}},"400":{"description":"The deployment is not a Kubernetes or ECS Remote Operator installation, or an enabled operation is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The enabled operations changed after the reviewed permissions were loaded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-metrics":{"get":{"operationId":"getProjectAiUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe AI Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"pricing":{"type":"object","properties":{"label":{"type":"string","enum":["Estimated provider cost"]},"coverage":{"type":"number","minimum":0,"maximum":1},"revision":{"type":"string","nullable":true}},"required":["label","coverage","revision"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","deploymentGroupId","name","externalId"]}},"models":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"publicModel":{"type":"string"},"provider":{"type":"string"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","publicModel","provider"]}},"customersTruncated":{"type":"boolean"},"modelsTruncated":{"type":"boolean"}},"required":["status","range","pricing","totals","timeSeries","customers","models","customersTruncated","modelsTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/encryption-metrics":{"get":{"operationId":"getProjectEncryptionUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getEncryptionUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Encryption Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","bucket"]}},"operations":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"operation":{"type":"string","enum":["encrypt","decrypt"]}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","operation"]}}},"required":["status","range","totals","timeSeries","operations"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/sandbox-metrics":{"get":{"operationId":"getProjectSandboxMetrics","x-speakeasy-group":"projects","x-speakeasy-name-override":"getSandboxMetrics","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Sandbox Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"externalId":{"type":"string","nullable":true},"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"lastSeenAt":{"type":"string","format":"date-time"}},"required":["deploymentGroupId","externalId","sessions","commands","lastSeenAt"]}},"customersTruncated":{"type":"boolean"}},"required":["status","range","totals","timeSeries","customers","customersTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups":{"post":{"operationId":"createDeploymentGroup","tags":["deployment-groups"],"summary":"Create a new deployment group","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group with this name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentGroups","tags":["deployment-groups"],"summary":"List deployment groups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of deployment groups","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"}}}]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-name":{"put":{"operationId":"ensureDeploymentGroupByName","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and name","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByNameRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-external-id":{"put":{"operationId":"ensureDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Optional for project-scoped API keys."},"required":false,"description":"Project ID or name. Optional for project-scoped API keys.","name":"project","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"required":true,"description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","name":"externalId","in":"query"}],"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project or deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/setup-links":{"post":{"operationId":"createSetupLink","tags":["setup-links"],"summary":"Create a customer setup link","description":"Ensures the Deployment Group identified by Project and external ID, then creates a group-scoped setup link with exact captured sources.","x-speakeasy-group":"setupLinks","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkRequest"}}}},"responses":{"200":{"description":"Customer environment ensured and setup link created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkResponse"}}}},"400":{"description":"Customer environment or setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Customer environment name or setup source conflicts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}":{"get":{"operationId":"getDeploymentGroup","tags":["deployment-groups"],"summary":"Get deployment group details","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"}],"responses":{"200":{"description":"Deployment group details","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"deploymentCount":{"type":"integer","description":"Current number of deployments in this deployment group"}},"required":["deploymentCount"]}]}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentGroup","tags":["deployment-groups"],"summary":"Update deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDeploymentGroup","tags":["deployment-groups"],"summary":"Delete deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Deployment group deleted successfully"},"400":{"description":"Cannot delete deployment group that has deployments","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/external-id":{"put":{"operationId":"setDeploymentGroupExternalId","tags":["deployment-groups"],"summary":"Set or clear a deployment group's external ID","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetDeploymentGroupExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group external ID updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group external ID already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/tokens":{"post":{"operationId":"createDeploymentGroupToken","tags":["deployment-groups"],"summary":"Create deployment group token","description":"Creates a deployment-group scoped API key and returns both the token and formatted deployment link","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenRequest"}}}},"responses":{"200":{"description":"Deployment group token created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"}}}},"400":{"description":"Deployment setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The project's sandbox configuration changed concurrently; retry the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/first-party-session":{"post":{"operationId":"createFirstPartyDeploymentSession","tags":["deployment-groups"],"summary":"Create first-party deployment session","description":"Mints a short-lived deployment-group token with the recommended self-deploy policy for the authenticated developer.","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"First-party deployment session created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateFirstPartyDeploymentSessionResponse"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external":{"get":{"operationId":"getExternalAIBinding","tags":["deployment-groups"],"summary":"Get external AI connection state","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"External AI connection state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBindingState"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putExternalAIBinding","tags":["deployment-groups"],"summary":"Connect or rotate an external AI provider key","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutExternalAIBindingRequest"}}}},"responses":{"202":{"description":"External AI connection stored and queued for checking","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBinding"}}}},"400":{"description":"The key is not valid for the selected provider","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The group already has an active cloud AI source","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Provider verification is temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteExternalAIBinding","tags":["deployment-groups"],"summary":"Revoke the external AI connection","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"External AI connection revoked"},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/models/{publicModelId}/checks":{"post":{"operationId":"createExternalAIModelCheck","tags":["deployment-groups"],"summary":"Queue an explicit external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":256},"required":true,"name":"publicModelId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"The potentially billable model check was queued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"400":{"description":"The model is not configured for this project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or binding not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/model-checks/{checkId}":{"get":{"operationId":"getExternalAIModelCheck","tags":["deployment-groups"],"summary":"Get an external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"checkId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Model check state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or check not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry":{"get":{"operationId":"getContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Container registry state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryState"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1,"maxLength":128}},"required":["deploymentId","resourceId"]}}}},"responses":{"200":{"description":"Registry route","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories":{"post":{"operationId":"createContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"}},"required":["name"]}}}},"responses":{"201":{"description":"Repository requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials":{"post":{"operationId":"createContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":64},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"minItems":1,"maxItems":100},"expiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["label","scope"]}}}},"responses":{"201":{"description":"Credential created; password is returned once","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateContainerRegistryCredentialResponse"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials/{credentialId}":{"delete":{"operationId":"revokeContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"required":true,"description":"Unique identifier for the container registry credential.","name":"credentialId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Credential revoked"},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories/{repositoryId}":{"delete":{"operationId":"deleteContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"required":true,"description":"Unique identifier for the container registry repository.","name":"repositoryId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"confirmName":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"disposition":{"type":"string","enum":["preserve","deleteContents"]}},"required":["confirmName","disposition"]}}}},"responses":{"202":{"description":"Repository deletion requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/verify":{"post":{"operationId":"verifyContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Verification requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/revoke":{"post":{"operationId":"revokeContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Registry revocation requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages":{"get":{"operationId":"listPackages","description":"List packages with optional filters. Returns packages ordered by creation date (newest first).","x-speakeasy-group":"packages","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Filter by package type"},"required":false,"description":"Filter by package type","name":"type","in":"query"},{"schema":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Filter by package status"},"required":false,"description":"Filter by package status","name":"status","in":"query"},{"schema":{"type":"string","pattern":"^rel_[0-9a-zA-Z]{28}$","description":"Filter by source release"},"required":false,"description":"Filter by source release","name":"sourceReleaseId","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search packages by type or version"},"required":false,"description":"Search packages by type or version","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of packages.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Package"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}":{"get":{"operationId":"getPackage","description":"Get details of a specific package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/rebuild":{"post":{"operationId":"rebuildPackages","description":"Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.","x-speakeasy-group":"packages","x-speakeasy-name-override":"rebuild","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to rebuild packages for"}},"required":["project"]}}}},"responses":{"200":{"description":"Packages rebuilt successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"packagesCreated":{"type":"integer","description":"Number of packages created"}},"required":["packagesCreated"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle the release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}/cancel":{"post":{"operationId":"cancelPackage","description":"Cancel a pending or building package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"cancel","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package canceled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"400":{"description":"Package cannot be canceled (not in pending or building status).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases":{"get":{"operationId":"listReleases","description":"Retrieve all releases.","x-speakeasy-group":"releases","x-speakeasy-name-override":"list","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","description":"Filter to releases promoted to this channel. Defaults to production."},"required":false,"description":"Filter to releases promoted to this channel. Defaults to production.","name":"channel","in":"query"},{"schema":{"type":"string","enum":["true","false"],"default":"false"},"required":false,"name":"allChannels","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search releases by commit message, branch, SHA, or release ID"},"required":false,"description":"Search releases by commit message, branch, SHA, or release ID","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by git branch (commitRef)"},"required":false,"description":"Filter by git branch (commitRef)","name":"branch","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by commit author login or name"},"required":false,"description":"Filter by commit author login or name","name":"author","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created after this date (ISO 8601)"},"required":false,"description":"Filter releases created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created before this date (ISO 8601)"},"required":false,"description":"Filter releases created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved releases.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createRelease","description":"Create a new release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateReleaseRequest"}}}},"responses":{"201":{"description":"Release created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Release"}}}},"400":{"description":"Invalid release request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/branches":{"get":{"operationId":"listReleaseBranches","description":"List distinct git branches across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listBranches","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search branches by name (case-insensitive contains)"},"required":false,"description":"Search branches by name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of branches to return"},"required":false,"description":"Maximum number of branches to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct branches.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/authors":{"get":{"operationId":"listReleaseAuthors","description":"List distinct commit authors across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listAuthors","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search authors by login or name (case-insensitive contains)"},"required":false,"description":"Search authors by login or name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of authors to return"},"required":false,"description":"Maximum number of authors to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct authors.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseAuthorFilterItem"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}":{"get":{"operationId":"getRelease","description":"Retrieve a release by ID.","x-speakeasy-group":"releases","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseListItemResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}/deployments":{"get":{"operationId":"listReleaseDeployments","description":"List the project's deployments with their rollout state relative to this release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseRolloutState"},"description":"Filter deployments by rollout state"},"required":false,"description":"Filter deployments by rollout state","name":"state","in":"query"},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved release deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseDeploymentsResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels":{"get":{"operationId":"listReleaseChannels","summary":"List release channels","description":"List the release channels configured for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Project release channels.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannel"}}},"required":["items"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createReleaseChannel","summary":"Create a release channel","description":"Create a release channel for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["name"],"additionalProperties":false}}}},"responses":{"201":{"description":"Channel created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"400":{"description":"Invalid release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}/promote":{"post":{"operationId":"promoteRelease","x-speakeasy-group":"releases","x-speakeasy-name-override":"promote","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"expectedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["releaseId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Release promoted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"404":{"description":"Project, channel, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel changed concurrently, or the sandbox bundle its release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}":{"delete":{"operationId":"deleteReleaseChannel","summary":"Delete a release channel","description":"Delete a release channel from a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"204":{"description":"Channel deleted."},"400":{"description":"Reserved channel.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel is still followed by deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments":{"get":{"operationId":"listDeployments","description":"Retrieve all deployments.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"list","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Filter by exact deployment name. Must be used with deploymentGroup."},"required":false,"description":"Filter by exact deployment name. Must be used with deploymentGroup.","name":"name","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name, public subdomain, or deployment group name"},"required":false,"description":"Search deployments by name, public subdomain, or deployment group name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved deployments.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid deployment list filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDeployment","description":"Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewDeploymentRequest"}}}},"responses":{"200":{"description":"Existing deployment returned for idempotent deployment-group registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"201":{"description":"Deployment created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"400":{"description":"Bad request - deployment group has reached max deployments limit.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden - insufficient permissions to create deployments in this context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment group not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/stats":{"get":{"operationId":"getDeploymentStats","description":"Get aggregated deployment statistics. Returns total count and breakdown by status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getStats","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name or deployment group name"},"required":false,"description":"Search deployments by name or deployment group name","name":"search","in":"query"}],"responses":{"200":{"description":"Deployment statistics retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentStats"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-environments":{"get":{"operationId":"listDeploymentFilterEnvironments","description":"List distinct effective environments used by deployments. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterEnvironments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Distinct environments retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-deployment-groups":{"get":{"operationId":"listDeploymentFilterDeploymentGroups","description":"List deployment groups with deployment counts. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterDeploymentGroups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return"},"required":false,"description":"Maximum number of items to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Deployment groups for filter retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"deploymentCount":{"type":"number"},"runningCount":{"type":"number","description":"Number of deployments in 'running' status"},"failedCount":{"type":"number","description":"Number of deployments in a failed status"},"inProgressCount":{"type":"number","description":"Number of deployments in an in-progress status (provisioning, updating, etc.)"}},"required":["id","name","deploymentCount","runningCount","failedCount","inProgressCount"]}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}":{"get":{"operationId":"getDeployment","description":"Retrieve a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentDetailResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/update-operations/{operationId}":{"get":{"operationId":"getDeploymentUpdateOperation","description":"Retrieve a deployment update operation by its durable operation ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getUpdateOperation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"required":true,"description":"Unique identifier for the deployment update operation.","name":"operationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment update operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}}}},"403":{"description":"The credential cannot read this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or update operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/info":{"get":{"operationId":"getDeploymentConnectionInfo","description":"Get deployment connection information including command endpoint and resource URLs.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment connection information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentConnectionInfo"}}}},"400":{"description":"Deployment not ready (no manager assigned).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/import":{"post":{"operationId":"importDeployment","description":"Import a deployment from resolved setup infrastructure such as CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"import","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportDeploymentRequest"}}}},"responses":{"200":{"description":"Deployment import was idempotent and returned an existing deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"201":{"description":"Deployment imported and created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/first-party-inputs":{"put":{"operationId":"setFirstPartyDeploymentInputs","description":"Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setFirstPartyDeploymentInputs","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Input values stored on the session token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsResponse"}}}},"400":{"description":"A deployment-group token scope is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The token is not a first-party deployment session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The requested release channel does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to store input values.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations":{"post":{"operationId":"createSetupRegistrationOperation","description":"Start a durable setup registration operation for CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createSetupRegistrationOperation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupRegistrationOperationRequest"}}}},"responses":{"202":{"description":"Setup registration operation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"400":{"description":"Invalid setup registration operation request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The credential cannot manage this setup registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed before callback acceptance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations/{id}":{"get":{"operationId":"getSetupRegistrationOperation","description":"Get setup registration operation status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getSetupRegistrationOperation","parameters":[{"schema":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"required":true,"description":"Unique identifier for the setup registration operation.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Setup registration operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"403":{"description":"The credential cannot read this setup registration result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Setup registration operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/delete":{"post":{"operationId":"deleteDeployment","description":"Delete, detach, or forget a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentRequest"}}}},"responses":{"202":{"description":"Deployment deletion request accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentResponse"}}}},"400":{"description":"Cannot delete the deployment in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/redeploy":{"post":{"operationId":"redeployDeployment","description":"Redeploy a running deployment with the same release and fresh environment variables. Sets status to update-pending.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"redeploy","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment redeployment triggered successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["message","operation"]}}}},"400":{"description":"Cannot redeploy - deployment must be running.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/pin-release":{"post":{"operationId":"pinDeploymentRelease","description":"Pin or unpin a running or runtime-failed deployment. Running deployments start an update; failed deployments retry toward the selected release.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"pinRelease","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PinReleaseRequest"}}}},"responses":{"202":{"description":"Release pin updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot pin release from the deployment's current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/release-channel":{"post":{"operationId":"setDeploymentReleaseChannel","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setReleaseChannel","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"channel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["channel"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployment release channel updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"400":{"description":"Channel release is unavailable for the deployment platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/retry":{"post":{"operationId":"retryDeployment","description":"Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"retry","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment retry enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Deployment is not in a failed state that can be retried.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment retry conflicts with current execution state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/inputs":{"get":{"operationId":"getDeploymentInputs","description":"Get the active input definitions and current non-secret values for a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment inputs returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInputsResponse"}}}},"403":{"description":"Insufficient permission to read deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentInputs","description":"Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Deployment inputs saved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsResponse"}}}},"400":{"description":"Input values are invalid for the deployment release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, project, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/compute":{"patch":{"operationId":"updateDeploymentCompute","description":"Update deployment-time compute pool selections and request reconciliation by the hosted manager.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateCompute","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentComputeRequest"}}}},"responses":{"200":{"description":"Compute settings saved or already current.","content":{"application/json":{"schema":{"type":"object","properties":{"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["outcome","operation"]}}}},"400":{"description":"Compute settings cannot be changed from the current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update compute settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/environment-variables":{"patch":{"operationId":"updateDeploymentEnvironmentVariables","description":"Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateEnvironmentVariables","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentEnvironmentVariablesRequest"}}}},"responses":{"202":{"description":"Environment variables updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Environment variables are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update environment variables.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/token":{"post":{"operationId":"createDeploymentToken","description":"Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenRequest"}}}},"responses":{"201":{"description":"Deployment token created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenResponse"}}}},"403":{"description":"Forbidden - insufficient permissions to issue a deployment token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}":{"put":{"operationId":"putDynamicContainer","description":"Create or replace a dynamic container in an existing deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"put","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string"},"required":false,"name":"if-match","in":"header"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutDynamicContainerRequest"}}}},"responses":{"202":{"description":"Desired state saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Generation conflict.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"501":{"description":"This deployment does not support dynamic containers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDynamicContainer","description":"Get one dynamic container's desired generation, status, and internal address.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic container.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDynamicContainer","description":"Remove a dynamic container from this deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"deleted":{"type":"boolean","enum":[true]}},"required":["name","deleted"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers":{"get":{"operationId":"listDynamicContainers","description":"List containers created after this deployment was installed.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic containers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}/logs":{"get":{"operationId":"getDynamicContainerLogs","description":"Read recent logs for one dynamic container.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"logs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":10080,"default":60},"required":false,"name":"sinceMinutes","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":200,"default":100},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"}],"responses":{"200":{"description":"Container logs.","content":{"application/json":{"schema":{"type":"object","properties":{"logs":{"type":"array","items":{"type":"object","properties":{"timestamp":{"type":"string","format":"date-time"},"level":{"type":"string"},"message":{"type":"string"},"replicaId":{"type":"string","nullable":true}},"required":["timestamp","level","message","replicaId"]}},"numHits":{"type":"number"},"nextCursor":{"type":"string","nullable":true},"partial":{"type":"boolean"},"errorCount":{"type":"number"}},"required":["logs","numHits","nextCursor","partial","errorCount"]}}}},"400":{"description":"Invalid cursor or time range.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Logs are unavailable for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/machines":{"get":{"operationId":"listDeploymentMachines","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listMachines","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines in every Horizon-backed ComputeCluster for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListDeploymentMachinesResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Horizon inventory could not be read.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation":{"get":{"operationId":"getDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current non-secret rotation state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationStatus"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"prepareDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"expectedRevision":{"type":"integer","minimum":0,"maximum":2147483644}},"required":["expectedRevision"],"additionalProperties":false}}}},"responses":{"200":{"description":"Prepared or replayed rotation; download values explicitly","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/cancel":{"post":{"operationId":"cancelDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Cancelled; apply the newer rollback values to restore the old credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/values":{"post":{"operationId":"getDeploymentCredentialRotationValues","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Secret values for this exact current rotation. Never persist in browser storage.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationValues"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers":{"post":{"operationId":"createManager","description":"Create a new manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewManagerRequest"}}}},"responses":{"201":{"description":"Manager created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Invalid private manager setup method.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A manager for this target already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listManagers","description":"Retrieve all managers.","x-speakeasy-group":"managers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search managers by name"},"required":false,"description":"Search managers by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of managers to return"},"required":false,"description":"Maximum number of managers to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved managers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Manager"}}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/setup-token":{"post":{"operationId":"retryManagerSetup","description":"Revoke previous private-manager setup tokens and issue a fresh setup token/config.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retrySetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"201":{"description":"Fresh manager setup token generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Manager setup cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or setup config not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/retry":{"post":{"operationId":"retryManager","description":"Retry private-manager setup. Returns a fresh setup action before the internal deployment exists, or requests retry for the internal deployment after it exists.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retry","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager retry handled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerRetryResponse"}}}},"400":{"description":"Manager cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or internal deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/cancel-setup":{"post":{"operationId":"cancelManagerSetup","description":"Cancel pending private-manager setup, revoke setup/runtime tokens, and remove the undeployed manager record.","x-speakeasy-group":"managers","x-speakeasy-name-override":"cancelSetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager setup canceled successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Manager setup cannot be canceled in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}":{"get":{"operationId":"getManager","description":"Retrieve a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"get","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Manager"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteManager","description":"Delete a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager deletion enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot delete the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Internal deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/domain-binding":{"get":{"operationId":"getManagerDomainBinding","description":"Get the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager domain binding.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateManagerDomainBinding","description":"Create, update, or remove the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"updateDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerDomainBinding"}}}},"responses":{"200":{"description":"Manager domain binding updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"400":{"description":"Invalid domain binding request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or domain not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/management-config":{"get":{"operationId":"getManagerManagementConfig","description":"Get the management configuration for a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getManagementConfig","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":true,"description":"Represents the target cloud platform.","name":"platform","in":"query"}],"responses":{"200":{"description":"Management config retrieved successfully.","content":{"application/json":{"schema":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/provision":{"post":{"operationId":"provisionManager","description":"Enqueue provisioning for a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"provision","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager provisioning enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot provision the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/update":{"post":{"operationId":"updateManager","description":"Update a manager to a specific release ID or active release.","x-speakeasy-group":"managers","x-speakeasy-name-override":"update","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerRequest"}}}},"responses":{"202":{"description":"Manager update enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot update the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/events":{"get":{"operationId":"listManagerEvents","description":"Retrieve all events of a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"listEvents","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Event"}}},"required":["items"]}}}},"400":{"description":"Manager does not expose user-accessible events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/token":{"post":{"operationId":"generateManagerToken","description":"Generate a short-lived JWT for direct browser → manager communication. Used for fetching command payloads and querying logs without routing sensitive data through the platform API.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenRequest"}}}},"responses":{"200":{"description":"Manager access token and connection info.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/binding-token":{"post":{"operationId":"generateManagerBindingToken","description":"Generate a short-lived deployment-scoped token for resolving opted-in remote bindings through the currently assigned manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerBindingToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenRequest"}}}},"responses":{"200":{"description":"Remote Bindings token and assigned manager URL.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenResponse"}}}},"403":{"description":"The caller cannot access Remote Bindings for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Assigned manager or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A sandbox token was requested but the deployment's current release publishes no remote sandbox, or more than one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed, such as an unknown binding kind.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/gcp-oauth-provider/resolve":{"post":{"operationId":"resolveManagerGcpOAuthProvider","description":"Resolve decrypted project-level Google Cloud OAuth provider settings for a manager-side deployment bootstrap.","x-speakeasy-group":"managers","x-speakeasy-name-override":"resolveGcpOAuthProvider","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderRequest"}}}},"responses":{"200":{"description":"Resolved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderResponse"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Manager cannot resolve this deployment group's project settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/heartbeat":{"post":{"operationId":"reportManagerHeartbeat","description":"Report Manager health status and metrics.","x-speakeasy-group":"managers","x-speakeasy-name-override":"reportHeartbeat","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatRequest"}}}},"responses":{"200":{"description":"Heartbeat acknowledged.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/deployment":{"get":{"operationId":"getManagerDeployment","description":"Get deployment details for a private manager (internal deployment platform, status, resources).","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDeployment","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager deployment details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDeployment"}}}},"404":{"description":"Manager not found or has no internal deployment (alien-hosted managers don't have deployment info).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/snapshot":{"get":{"operationId":"getContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"responses":{"200":{"description":"Complete desired registry snapshot assigned to this Manager","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryManagerSnapshot"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/applied":{"post":{"operationId":"applyContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"routeId":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"desiredRevision":{"type":"integer","minimum":0},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"status":{"type":"string","enum":["ready","deleted","failed"]},"routableUpstreamName":{"type":"string","nullable":true,"minLength":1},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["id","status","routableUpstreamName","error"],"additionalProperties":false}},"verification":{"type":"object","nullable":true,"properties":{"succeeded":{"type":"boolean"},"observedAt":{"type":"string","format":"date-time"},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["succeeded","observedAt","error"],"additionalProperties":false}},"required":["routeId","desiredRevision","repositories","verification"],"additionalProperties":false}}}},"responses":{"200":{"description":"Applied registry snapshot revision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplyContainerRegistrySnapshotResponse"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/prepare":{"post":{"operationId":"prepareOperatorManifestPackage","tags":["operator-manifests"],"summary":"Prepare the white-labeled Operator image for an Operate install","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageRequest"}}}},"responses":{"200":{"description":"Operator image package created or reused.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/render":{"post":{"operationId":"renderOperatorManifest","tags":["operator-manifests"],"summary":"Render a Kubernetes Operator manifest","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestRequest"}}}},"responses":{"200":{"description":"Operator manifest rendered successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestResponse"}}}},"400":{"description":"An enabled custom plugin has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Operator image package is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid platform or manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/bootstrap-write-check":{"post":{"operationId":"checkEcsBootstrapWrite","tags":["operator-manifests"],"description":"Checks a Remote Operator setup token and its exact AWS target before the local bootstrap command writes a registration secret. A registered stack cannot use this path.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EcsBootstrapWriteCheckRequest"}}}},"responses":{"204":{"description":"The setup token may write the bootstrap secret."},"400":{"description":"The AWS target is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"The setup token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The setup token cannot read this deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The setup token does not match the target or the stack has registered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/render":{"post":{"operationId":"renderOperatorEcsCloudFormation","tags":["operator-manifests"],"summary":"Render a Remote Operator ECS Fargate CloudFormation installer","description":"Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from the project's enabled operations; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationRequest"}}}},"responses":{"200":{"description":"CloudFormation installer rendered, or null template and deployCommand while imagePending is true.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationResponse"}}}},"400":{"description":"Enabled AWS permissions cannot be safely compiled or directly deployed with the supplied resource ceilings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not authorized to update the project or use the selected Operator image package.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Operator image package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The selected Operator image package is unavailable, or the registered stack belongs to a different ECS cluster.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request body validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid Operator image or AWS manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys":{"get":{"operationId":"listAPIKeys","description":"Retrieve all API keys for the current workspace.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved API keys.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/APIKey"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAPIKey","description":"Create a new API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyRequest"}}}},"responses":{"201":{"description":"API key created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyResponse"}}}},"403":{"description":"Insufficient permissions to create API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/{id}":{"get":{"operationId":"getAPIKey","description":"Retrieve a specific API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateAPIKey","description":"Update an API key (enable/disable, change description).","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateAPIKeyRequest"}}}},"responses":{"200":{"description":"API key updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeAPIKey","description":"Revoke (soft delete) an API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"revoke","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"API key revoked successfully."},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/batch-delete":{"post":{"operationId":"deleteAPIKeys","description":"Permanently delete multiple API keys.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"deleteMultiple","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteAPIKeysRequest"}}}},"responses":{"200":{"description":"API keys deleted successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"deletedCount":{"type":"number"}},"required":["deletedCount"]}}}},"403":{"description":"Insufficient permissions to delete API keys.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains":{"get":{"operationId":"listDomains","description":"List system domains and workspace domains.","x-speakeasy-group":"domains","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domains.","content":{"application/json":{"schema":{"type":"object","properties":{"domains":{"type":"array","items":{"$ref":"#/components/schemas/DomainWithUsage"}}},"required":["domains"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDomain","description":"Create a workspace domain and optional initial endpoints.","x-speakeasy-group":"domains","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"setup":{"type":"object","properties":{"deploymentPortal":{"type":"boolean"},"packages":{"type":"boolean"},"deploymentUrlProjectId":{"type":"string","nullable":true,"pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"managerIds":{"type":"array","items":{"type":"string"}}}}},"required":["domain"]}}}},"responses":{"200":{"description":"Returned an existing workspace domain claim.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"201":{"description":"Created domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Domain is reserved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/endpoints":{"post":{"operationId":"createDomainEndpoint","description":"Create an endpoint under a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"createEndpoint","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"owner":{"type":"object","properties":{"type":{"type":"string","enum":["workspace","project","manager"]},"id":{"type":"string"}},"required":["type","id"]}},"required":["kind"]}}}},"responses":{"201":{"description":"Created endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Bad request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Endpoint cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}":{"get":{"operationId":"getDomain","description":"Get domain by ID.","x-speakeasy-group":"domains","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDomain","description":"Delete a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}},"required":["success"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain is in use.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/refresh":{"post":{"operationId":"refreshDomain","description":"Refresh workspace domain verification.","x-speakeasy-group":"domains","x-speakeasy-name-override":"refresh","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain verification refresh requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events":{"get":{"operationId":"listEvents","description":"Retrieve all events.","x-speakeasy-group":"events","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter events to a single deployment."},"required":false,"description":"Filter events to a single deployment.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Filter events to a single release."},"required":false,"description":"Filter events to a single release.","name":"releaseId","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["releaseCreatedAt"]},"description":"Optional fields to include: releaseCreatedAt"},"required":false,"description":"Optional fields to include: releaseCreatedAt","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/EventListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events/{id}":{"get":{"operationId":"getEvent","description":"Retrieve an event by ID.","x-speakeasy-group":"events","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"required":true,"description":"Unique identifier for the event.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved event.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Event"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents":{"get":{"operationId":"listIncidents","description":"List authorized incidents without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string"},"required":false,"name":"projectId","in":"query"},{"schema":{"type":"string","enum":["queued","running","halted","complete","error","canceled"]},"required":false,"name":"status","in":"query"},{"schema":{"type":"string","maxLength":256},"required":false,"name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":25},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incidents.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentListResponse"}}}},"400":{"description":"Invalid request or cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents/{id}":{"get":{"operationId":"getIncident","description":"Get an authorized incident without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incident.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Incident not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens":{"get":{"operationId":"listMachinesJoinTokens","x-speakeasy-group":"machines","x-speakeasy-name-override":"listJoinTokens","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Join tokens for a Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMachinesJoinTokensResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"createJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Newly minted Machines join token. Existing tokens keep working; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/rotate":{"post":{"operationId":"rotateMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"rotateJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Rotated Machines join token. Revokes all existing tokens, then mints a new one; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/{tokenId}":{"delete":{"operationId":"revokeMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"revokeJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"tokenId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines join token revocation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}/drain":{"delete":{"operationId":"cancelMachinesMachineDrain","x-speakeasy-group":"machines","x-speakeasy-name-override":"cancelMachineDrain","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines drain cancellation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelMachinesMachineDrainResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"drainMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"drainMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineRequest"}}}},"responses":{"200":{"description":"Machines drain request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}":{"delete":{"operationId":"removeMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"removeMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines remove request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoveMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/bootstrap":{"post":{"operationId":"bootstrapCommands","description":"Resolve a deployment's current manager and mint a five-minute command capability. Sender tokens can dispatch and observe commands only for this deployment. Receiver tokens can lease and complete commands only for the resolved Container or Daemon target.","x-speakeasy-group":"commands","x-speakeasy-name-override":"bootstrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapRequest"}}}},"responses":{"200":{"description":"Manager connection details and a short-lived command capability.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapResponse"}}}},"400":{"description":"Invalid request or deployment state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot operate this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, manager, or receiver target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The selected resource cannot run an external receiver.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands":{"get":{"operationId":"listCommands","description":"Retrieve commands. Use for dashboard analytics and command history.","x-speakeasy-group":"commands","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Filter by command state"},"required":false,"description":"Filter by command state","name":"state","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Filter by command name"},"required":false,"description":"Filter by command name","name":"name","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search commands by name"},"required":false,"description":"Search commands by name","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created after this date (ISO 8601)"},"required":false,"description":"Filter commands created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created before this date (ISO 8601)"},"required":false,"description":"Filter commands created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deployment","project"]},"description":"Optional fields to include: deployment, project"},"required":false,"description":"Optional fields to include: deployment, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved commands.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/CommandListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createCommand","description":"Create command metadata. Called by manager when processing commands. Returns project info for routing decisions.","x-speakeasy-group":"commands","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandRequest"}}}},"responses":{"201":{"description":"Command created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandResponse"}}}},"400":{"description":"Deployment is not ready or has no assigned manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The operation access request is no longer approved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The deployment manager is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/names":{"get":{"operationId":"listCommandNames","description":"List distinct command names. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listNames","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search command names (prefix match)"},"required":false,"description":"Search command names (prefix match)","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct command names.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandNamesResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/deployments":{"get":{"operationId":"listCommandDeployments","description":"List distinct deployments that have commands, including deployment group info. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search deployment or deployment group names"},"required":false,"description":"Search deployment or deployment group names","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct deployments that have commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandDeploymentsResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/target":{"get":{"operationId":"resolveCommandTarget","description":"Resolve which resource a command for this deployment would be addressed to, and how it would be delivered. Fails when the deployment has no command-capable resources, or more than one and no explicit target was named.","x-speakeasy-group":"commands","x-speakeasy-name-override":"resolveTarget","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment to resolve the target for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Deployment to resolve the target for","name":"deploymentId","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Explicit resource id to resolve; must be a command-capable resource"},"required":false,"description":"Explicit resource id to resolve; must be a command-capable resource","name":"target","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":255,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead."},"required":false,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead.","name":"command","in":"query"}],"responses":{"200":{"description":"Resolved command target.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolvedCommandTarget"}}}},"404":{"description":"Deployment or target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}":{"patch":{"operationId":"updateCommand","description":"Update command state. Called by manager when command is dispatched or completes.","x-speakeasy-group":"commands","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateCommandRequest"}}}},"responses":{"200":{"description":"Command updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getCommand","description":"Retrieve a command by ID.","x-speakeasy-group":"commands","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["true"],"description":"Explicitly confirm access to an operation result marked sensitive."},"required":false,"description":"Explicitly confirm access to an operation result marked sensitive.","name":"confirmSensitiveOutput","in":"query"}],"responses":{"200":{"description":"Retrieved command.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid operation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/dispatch":{"post":{"operationId":"dispatchCommand","description":"Atomically mark a command DISPATCHED unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"dispatch","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandRequest"}}}},"responses":{"200":{"description":"Dispatch attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/complete":{"post":{"operationId":"completeCommand","description":"Atomically transition a command to a terminal state (SUCCEEDED, FAILED, or EXPIRED) unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"complete","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandRequest"}}}},"responses":{"200":{"description":"Completion attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/increment-attempt":{"post":{"operationId":"incrementCommandAttempt","description":"Atomically increment the command's attempt counter and return the new value.","x-speakeasy-group":"commands","x-speakeasy-name-override":"incrementAttempt","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Attempt incremented.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncrementCommandAttemptResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions":{"get":{"operationId":"listDebugSessions","description":"Retrieve debug sessions for dashboard audit. Filters: project, deployment, state, mode.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Filter by session state"}]},"required":false,"description":"Filter by session state","name":"state","in":"query"},{"schema":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model (push/pull). Joins against the parent deployment."},"required":false,"description":"Filter by deployment model (push/pull). Joins against the parent deployment.","name":"mode","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Filter by cloud provider. Joins against the parent deployment."},"required":false,"description":"Filter by cloud provider. Joins against the parent deployment.","name":"provider","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Paginated debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSessionListResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDebugSession","description":"Create a debug-session audit row. Called by the manager when a pull or push debug tunnel is opened. Workspace + project derived from deployment.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDebugSessionRequest"}}}},"responses":{"201":{"description":"Debug session created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Deployment or access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions/{id}":{"patch":{"operationId":"updateDebugSession","description":"Update debug-session state. Called by manager on tunnel attach, close, or deadline expiry.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDebugSessionRequest"}}}},"responses":{"200":{"description":"Debug session updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Debug session not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDebugSession","description":"Retrieve a debug session by ID.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved debug session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info":{"get":{"operationId":"getDeploymentInfo","description":"Get deployment information for the deployment portal. Accepts both deployment-scoped and deployment-group-scoped API keys. Returns project information, package status/outputs, and either deployment or deployment group details depending on the token type. Poll this endpoint to check if packages are ready.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":false,"description":"Represents the target cloud platform.","name":"platform","in":"query"},{"schema":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":false,"name":"setupItem","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"updateOperationId","in":"query"}],"responses":{"200":{"description":"Deployment information retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInfo"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-scoped or deployment-group-scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/compute-plan":{"post":{"operationId":"planDeploymentCompute","description":"Plan deployment compute for the active release before stack preparation. The response contains recommended machine and scale choices for cloud compute pools.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"planCompute","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Compute plan returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentComputePlan"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/prepare-stack":{"post":{"operationId":"prepareDeploymentStack","description":"Prepare the active release stack for a deployment portal setup session. The response contains the generated stack shape plus setup compatibility metadata.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"prepareStack","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"saveForSetup":{"type":"boolean","description":"Persist validated choices for the exact blocked update; does not apply cloud changes."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Prepared stack returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PreparedDeploymentStack"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/install-url":{"post":{"operationId":"slackIntegrationInstallUrl","description":"Generate the Slack OAuth consent URL for this workspace.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"installUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"OAuth URL the dashboard should redirect the user to.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackInstallUrlResponse"}}}},"500":{"description":"Server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/status":{"get":{"operationId":"slackIntegrationStatus","description":"Return the Slack install for this workspace (if any).","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"status","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackIntegrationStatus"}}}}}}},"/v1/integrations/slack/channels":{"get":{"operationId":"slackIntegrationChannels","description":"List public Slack channels for this workspace's install. Used by the dashboard's notification-channel picker.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"listChannels","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Public channels.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackChannelsResponse"}}}},"400":{"description":"Workspace not connected to Slack.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/notification-channel":{"put":{"operationId":"slackIntegrationSetNotificationChannel","description":"Configure which Slack channel receives ai-agent monitor reports.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"setNotificationChannel","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelRequest"}}}},"responses":{"200":{"description":"Channel saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelResponse"}}}},"400":{"description":"Not connected, or join failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/installation":{"delete":{"operationId":"slackIntegrationUninstall","description":"Uninstall the Slack integration for this workspace. Revokes the bot token at Slack and deletes the row.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"uninstall","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Uninstalled."}}}},"/v1/agent-sessions":{"get":{"operationId":"listAgentSessions","description":"List ai-agent monitor sessions for this workspace, or for one project. Newest first, capped at 50.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},{"description":"Only sessions bound to this project. Omit to list the whole workspace."}]},"required":false,"description":"Only sessions bound to this project. Omit to list the whole workspace.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionListResponse"}}}}}}},"/v1/agent-sessions/{id}":{"get":{"operationId":"getAgentSession","description":"Retrieve one ai-agent monitor session by id.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionDetail"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/events":{"get":{"operationId":"listAgentSessionEvents","description":"Incrementally read a session's event log (steps, tool calls, report deltas, approvals, status transitions). Pass the previous response's `latestSeq` as `after` to fetch only new events.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"events","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","nullable":true,"minimum":0,"default":0},"required":false,"name":"after","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":500,"default":200},"required":false,"name":"limit","in":"query"}],"responses":{"200":{"description":"Events after the cursor, oldest first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionEventsResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/stop":{"post":{"operationId":"stopAgentSession","description":"Stop (cancel) a running or queued ai-agent monitor session. Proxies to the ai-agent service, minting a fresh CLI session for the caller so the ai-agent's own auth applies. Idempotent — stopping an already-terminal session is a 200 no-op.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"stop","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Already terminal / no-op.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"202":{"description":"Cancel accepted; session stopped.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"AI agent service is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins":{"get":{"operationId":"listOperationsPlugins","description":"List available operations plugins (builtin + custom) for a project, with their operations and risk tiers.","x-speakeasy-group":"operations","x-speakeasy-name-override":"listPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The operations plugin catalog.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListOperationsPluginsResponse"}}}},"409":{"description":"A persisted custom plugin has invalid metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"publishOperationsPlugin","description":"Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"publishPlugin","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginRequest"}}}},"responses":{"201":{"description":"The plugin was published, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginResponse"}}}},"400":{"description":"Invalid metadata, or no bundle was uploaded for this name/version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A plugin with this name is already published at this version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/builtin/enabled":{"put":{"operationId":"setBuiltinOperationsPlugins","description":"Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setBuiltinPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsRequest"}}}},"responses":{"200":{"description":"The enabled built-in plugin set was replaced, with the cloud permission delta.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsResponse"}}}},"400":{"description":"One or more plugin names are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/upload-url":{"post":{"operationId":"createOperationsBundleUploadUrl","description":"Get a presigned S3 URL to upload a custom operations plugin bundle ZIP. Upload the ZIP with a PUT to the returned url (sending the given Content-Type), then call POST /plugins to register it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"createBundleUploadUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlRequest"}}}},"responses":{"200":{"description":"A presigned upload URL for the bundle ZIP.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlResponse"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Bundle storage is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/{name}/enabled":{"patch":{"operationId":"setOperationsPluginEnabled","description":"Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setPluginEnabled","parameters":[{"schema":{"type":"string","description":"Plugin name."},"required":true,"description":"Plugin name.","name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledRequest"}}}},"responses":{"200":{"description":"The plugin's enabled state was updated, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledResponse"}}}},"404":{"description":"No such plugin for this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The plugin metadata is invalid for the requested enabled state, or the permission delta differs from `expectedPermissionDiff`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/policy":{"get":{"operationId":"getOperationsPolicy","description":"Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"getPolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The approval policy rules and default.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateOperationsPolicy","description":"Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"updatePolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateOperationsPolicyRequest"}}}},"responses":{"200":{"description":"The updated approval policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/invoke":{"post":{"operationId":"invokeOperation","description":"Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"invoke","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationRequest"}}}},"responses":{"200":{"description":"The operation was dispatched or queued for approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationResponse"}}}},"400":{"description":"Parameters do not satisfy the operation's published input schema.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not create commands for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Plugin or operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Plugin is disabled or has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/verify-check":{"post":{"operationId":"verifyOperationCheck","description":"One verification poll cycle for an original operation command. Loads that command's authoritative stored result and dispatch-time verification contract, dispatches the frozen read-only poll operation once, and evaluates its frozen success condition. Callers poll this repeatedly per the returned policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"verifyCheck","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckRequest"}}}},"responses":{"200":{"description":"The outcome of this single verification poll cycle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckResponse"}}}},"400":{"description":"The verification command cannot be dispatched to the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not dispatch verification commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or original command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid verification command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests":{"post":{"operationId":"createAccessRequest","description":"Create an access request — either plan-backed (an ai-agent investigation's exact commands) or plan-less (a CLI-originated exact operation or wildcard pattern, resolved and frozen here). Plan-backed requests await the engineer gate (status `pending-approval`); plan-less requests are queued immediately since the requester is asking for their own access (status `queued`).","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAccessRequest"}}}},"responses":{"201":{"description":"The created access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"400":{"description":"Invalid create payload or requested expiry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The requester cannot access the target deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or remediation plan not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Replay key payload conflicts or the remediation plan already has a request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listAccessRequests","description":"List a project's access requests, newest first.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AccessRequestStatus"},"description":"Filter by status."},"required":false,"description":"Filter by status.","name":"status","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Only requests proposed by this investigation's remediation plan."},"required":false,"description":"Only requests proposed by this investigation's remediation plan.","name":"agentSessionId","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"The project's access requests.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/queue":{"post":{"operationId":"queueAccessRequest","description":"Engineer gate — approve a pending access request, queuing it for the operator to materialize. Records who queued it.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The queued access request, with the customer approve command.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"kubectlApprove":{"type":"string","nullable":true}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","kubectlApprove"]}}}},"400":{"description":"The requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not pending approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/approve":{"post":{"operationId":"approveAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may approve a queued access request. Actor identity comes from authentication; method/source are audit context only.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}},"approvedForMinutes":{"type":"integer","minimum":0,"exclusiveMinimum":true}},"required":["method"]}}}},"responses":{"200":{"description":"The approved access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"approvalMethod":{"$ref":"#/components/schemas/AccessRequestApprovalMethod"}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","approvalMethod"]}}}},"400":{"description":"The approval window or requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued, or its requester identity is unknown and a new request is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/deny":{"post":{"operationId":"denyAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may reject a queued access request. Actor identity comes from authentication.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}}},"required":["method"]}}}},"responses":{"200":{"description":"The rejected access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued (already approved, denied, expired, or still pending the engineer gate).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/coordinates":{"get":{"operationId":"getAccessRequestCoordinates","description":"The customer's kubectl approve command for a queued access request, or null until the operator has materialized the grant CR and reported its coordinates. Polled by the Slack handler to update the access-plan card.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The approve command (or null) and current status.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"kubectlApprove":{"type":"string","nullable":true}},"required":["status","kubectlApprove"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/pending":{"get":{"operationId":"listPendingAccessRequests","description":"Operator-facing: queued access requests whose requester deadline has not elapsed, for the access-request sync loop to materialize as grant CRs.","x-speakeasy-ignore":true,"parameters":[{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Queued access requests for the deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"requests":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"requestedExpiresAt":{"type":"string","nullable":true}},"required":["id","title","reason","commands","debugGrant","requestedExpiresAt"]}},"revokedRequestIds":{"type":"array","items":{"type":"string"},"description":"Requests revoked in the last six hours, or revoked while their approved window is still open, so the operator can mark their grant CRs REVOKED. Older operators ignore this field."}},"required":["requests","revokedRequestIds"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/materialized":{"post":{"operationId":"reportMaterializedAccessRequests","description":"Operator-facing: record the namespace + CRD plural the operator materialized the grant CRs in, so the control plane can render the customer's exact kubectl approve command.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"requestIds":{"type":"array","items":{"type":"string"}},"namespace":{"type":"string","minLength":1},"resourcePlural":{"type":"string","minLength":1}},"required":["deploymentId","requestIds","namespace","resourcePlural"]}}}},"responses":{"200":{"description":"Number of requests updated with CR coordinates.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/approvals":{"post":{"operationId":"reportAccessApprovals","description":"Operator-facing: record the customer's approval windows reported back by the sync loop. Retires requester-expired requests and skips stale windows without blocking live approvals. Moves live requests to customer-approved and resumes the investigation to dispatch commands.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"approvals":{"type":"array","items":{"type":"object","properties":{"requestId":{"type":"string"},"approvedUntil":{"type":"string"}},"required":["requestId","approvedUntil"]}}},"required":["deploymentId","approvals"]}}}},"responses":{"200":{"description":"Number of approvals recorded.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"400":{"description":"Invalid approval report payload.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/live-debug-grant":{"get":{"operationId":"getLiveDebugGrant","description":"Find an approved, unexpired access request the caller created whose debug grant matches this deployment and tool (and, when given, namespace/cloudScope). Returns the most recently approved match, or 404 when none is live. Used to reuse an existing grant instead of proposing a new access request. Only the requester's own grants match: a debug session must present a grant its caller requested, so another principal's grant is never returned here.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"The deployment to check for a live debug grant.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"The deployment to check for a live debug grant.","name":"deploymentId","in":"query"},{"schema":{"$ref":"#/components/schemas/DebugGrantTool"},"required":true,"name":"debugTool","in":"query"},{"schema":{"type":"string","description":"Match a `kubectl` grant scoped to this namespace exactly."},"required":false,"description":"Match a `kubectl` grant scoped to this namespace exactly.","name":"debugNamespace","in":"query"},{"schema":{"type":"string","description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly."},"required":false,"description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly.","name":"debugCloudScope","in":"query"}],"responses":{"200":{"description":"A live access request with a matching debug grant.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"No approved, unexpired access request matches.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/activity":{"get":{"operationId":"getAccessRequestActivity","description":"The operation commands and debug sessions an access request authorized, with each command's verification outcome. Authorized like getAccessRequest.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The request's operations and debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRequestActivity"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/revoke":{"post":{"operationId":"revokeAccessRequest","description":"Revoke a pending, queued or customer-approved access request. The principal that created the request, or any workspace member or administrator who can read its project, may revoke it. Commands the grant authorized that have not been dispatched are failed; dispatched commands finish. Linked debug sessions are stopped and refuse their next request. Revoking an already revoked request returns it unchanged.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeAccessRequest"}}}},"responses":{"200":{"description":"The revoked access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"The caller may read but not revoke this request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The request has already expired or been rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}":{"get":{"operationId":"getAccessRequest","description":"Get an access request by id.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/list":{"post":{"operationId":"syncList","description":"List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.","x-speakeasy-group":"sync","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListRequest"}}}},"responses":{"200":{"description":"Full deployment records returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/context":{"post":{"operationId":"syncContext","description":"Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.","x-speakeasy-group":"sync","x-speakeasy-name-override":"context","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncContextRequest"}}}},"responses":{"200":{"description":"Computed deployment context returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"}}}},"404":{"description":"Deployment not found or not assigned to this manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to build deployment context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/acquire":{"post":{"operationId":"syncAcquire","description":"Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.","x-speakeasy-group":"sync","x-speakeasy-name-override":"acquire","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireRequest"}}}},"responses":{"200":{"description":"Deployments acquired successfully (empty arrays if none available). Failures indicate deployments that were locked but failed during context building - their locks have been released.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/reconcile":{"post":{"operationId":"syncReconcile","description":"Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.","x-speakeasy-group":"sync","x-speakeasy-name-override":"reconcile","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileRequest"}}}},"responses":{"200":{"description":"State reconciled successfully. If target is present, continue deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment locked (pull) or session mismatch (push).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/renew":{"post":{"operationId":"syncRenew","x-speakeasy-group":"sync","x-speakeasy-name-override":"renew","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncRenewRequest"}}}},"responses":{"200":{"description":"Renewal processed. Inspect `leases` for per-deployment outcomes; a lost lease is reported there rather than failing the whole batch.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when every requested deployment was renewed."},"leases":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"renewed":{"type":"boolean","description":"False when this session no longer holds a live lease."},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["deploymentId","renewed","leaseExpiresAt"]},"description":"Per-deployment renewal outcome."}},"required":["success","leases"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The session no longer owns the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/release":{"post":{"operationId":"syncRelease","description":"Release a deployment lock. Must be called after processing an acquired deployment, even if processing failed. This is critical to avoid deadlocks.","x-speakeasy-group":"sync","x-speakeasy-name-override":"release","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReleaseRequest"}}}},"responses":{"200":{"description":"Lock released successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when released or the exact terminal receipt was acknowledged. False when completion could not be established."}},"required":["success"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources":{"get":{"operationId":"listInventory","x-speakeasy-group":"resources","x-speakeasy-name-override":"listInventory","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Unified managed and observed resource inventory rows.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"},"source":{"type":"string","enum":["managed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt","source","deploymentId","deploymentName"]},{"type":"object","properties":{"source":{"type":"string","enum":["observed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"rawKind":{"type":"string"},"alienResourceId":{"type":"string","nullable":true},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["source","deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","name","rawKind","alienResourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}":{"get":{"operationId":"listResourceOverview","x-speakeasy-group":"resources","x-speakeasy-name-override":"listOverview","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Compute resource overview rows from latest heartbeats.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/{resourceId}/deployments":{"get":{"operationId":"listResourceDeployments","description":"List deployments where the selected resource is installed.","x-speakeasy-group":"resources","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Deployments where the resource is installed.","content":{"application/json":{"schema":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"deployments":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt"]}}},"required":["resourceType","resourceId","deployments"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/deployments/{deploymentId}/{resourceId}":{"get":{"operationId":"getResourceDeploymentDetail","x-speakeasy-group":"resources","x-speakeasy-name-override":"getDeploymentDetail","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Latest heartbeat detail for one resource deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"deployment":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"},"desiredImage":{"type":"string","nullable":true}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt","desiredImage"]},"heartbeat":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"staleAt":{"type":"string","format":"date-time"},"platformStale":{"type":"boolean"},"heartbeat":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"raw":{"type":"array","items":{"nullable":true}}},"required":["status","deploymentId","resourceId","resourceType","backend","controllerPlatform","observedAt","staleAt","platformStale","heartbeat","raw"]},{"type":"object","properties":{"status":{"type":"string","enum":["missing"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"}},"required":["status","deploymentId","resourceId","resourceType"]}]}},"required":["deployment","heartbeat"]}}}},"404":{"description":"Deployment or resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys":{"get":{"operationId":"listAwsVirtualKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"AWS Virtual Keys in a project","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKeys":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}},"required":["virtualKeys"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAwsVirtualKey","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"selector":{"oneOf":[{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false}]},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128},"alias":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"description":{"type":"string","nullable":true,"maxLength":8192},"deletionWindowDays":{"type":"integer","minimum":7,"maximum":30,"default":30},"tags":{"type":"object","additionalProperties":{"type":"string","maxLength":256},"default":{}}},"required":["selector","awsAccountId","awsRegion","idempotencyKey"]}}}},"responses":{"200":{"description":"Created or resumed Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Enterprise Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Gateway unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/rotate-credential":{"post":{"operationId":"rotateAwsVirtualKeyCredential","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"generation":{"type":"integer","minimum":2}},"required":["generation"]}}}},"responses":{"200":{"description":"The resumable XKS proxy credential rotation bundle","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot begin rotation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/restore":{"post":{"operationId":"restoreAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key awaiting a successful AWS XKS canary after restore","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot be restored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/finalize-deletion":{"post":{"operationId":"finalizeAwsVirtualKeyDeletion","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key whose final AWS KMS deletion was observed","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key deletion cannot be finalized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/decommission":{"post":{"operationId":"decommissionAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"},"deletionScheduledAt":{"type":"string","format":"date-time"}},"required":["kmsKeyArn","deletionScheduledAt"]}}}},"responses":{"200":{"description":"Virtual Key with AWS deletion scheduled","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"AWS key does not match","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}":{"get":{"operationId":"getAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"responses":{"200":{"description":"AWS Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/continue":{"post":{"operationId":"continueAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"customKeyStoreId":{"type":"string","pattern":"^cks-[A-Za-z0-9]+$"},"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["customKeyStoreId","kmsKeyArn"]}}}},"responses":{"200":{"description":"Updated AWS setup facts","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Setup facts conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resolve":{"get":{"operationId":"resolve","tags":["resolve"],"summary":"Resolve manager for a project and platform","description":"Returns the manager URL for a given project and platform. The project can be provided as a query parameter, or derived from the token's scope (project-scoped, deployment-group-scoped, or deployment-scoped tokens carry an implicit project). This is the single entry point for all CLI tools to discover which manager to talk to.","x-speakeasy-group":"resolve","x-speakeasy-name-override":"resolve","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform to resolve the manager for"},"required":true,"description":"Target platform to resolve the manager for","name":"platform","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope)."},"required":false,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope).","name":"project","in":"query"}],"responses":{"200":{"description":"Manager resolved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveResponse"}}}},"400":{"description":"Missing required project parameter for this token type.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found or no manager available for platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Manager not ready yet (no URL reported). Retry after a delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/cloud-regions":{"get":{"operationId":"getCloudRegions","description":"Get cloud regions supported by this Alien environment.","x-speakeasy-group":"cloudRegions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Supported cloud regions retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudRegionsResponse"}}}}}}},"/v1/billing/audit-log":{"get":{"operationId":"listBillingAuditLog","description":"List billing activity entries for the current workspace.","x-speakeasy-group":"billing","x-speakeasy-name-override":"listAuditLog","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"number","minimum":1,"maximum":200,"default":50},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor: id from the previous page."},"required":false,"description":"Cursor: id from the previous page.","name":"before","in":"query"}],"responses":{"200":{"description":"Audit-log rows newest-first.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/BillingAuditLogRow"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"]}}}}}}},"/v1/billing/entitlements":{"get":{"operationId":"getWorkspaceBillingEntitlements","description":"Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.","x-speakeasy-group":"billing","x-speakeasy-name-override":"getEntitlements","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace billing entitlements.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceBillingEntitlements"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/gateways/{gateway}/overview":{"get":{"operationId":"getWorkspaceGatewayOverview","description":"Get compact cross-Project setup and customer status for a workspace Gateway.","x-speakeasy-group":"gateways","x-speakeasy-name-override":"getWorkspaceOverview","parameters":[{"schema":{"$ref":"#/components/schemas/GatewayKind"},"required":true,"description":"Alien Gateway a customer deployment runs","name":"gateway","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace Gateway overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceGatewayOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}}}}
+{"openapi":"3.0.0","info":{"title":"Alien API","version":"1.0.0","contact":{"name":"Alien Team","url":"https://alien.dev"}},"servers":[{"url":"https://api.alien.dev","description":"Alien API - Production"}],"security":[{"apiKey":[]}],"components":{"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","bearerFormat":"API key","description":"API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys"}},"schemas":{"WorkspaceInvitationPreview":{"type":"object","properties":{"kind":{"type":"string","enum":["email","link"]},"workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name","logoUrl"]},"inviter":{"type":"object","nullable":true,"properties":{"name":{"type":"string"},"image":{"type":"string","nullable":true,"format":"uri"}},"required":["name","image"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"state":{"type":"string","enum":["active","accepted","expired","revoked"]},"emailHint":{"type":"string","nullable":true}},"required":["kind","workspace","inviter","role","expiresAt","state","emailHint"],"additionalProperties":false},"WorkspaceRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"Role for workspace-scoped service accounts","example":"workspace.member"},"APIError":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"requestId":{"type":"string","description":"Request ID echoed in the x-request-id response header and server logs."}},"required":["code","message","internal"]},"Membership":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"role":{"type":"string"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","logoUrl","role","createdAt"],"additionalProperties":false},"UserProfile":{"type":"object","properties":{"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","description":"User's email address"},"name":{"type":"string","description":"User's display name"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"},"githubUsername":{"type":"string","nullable":true,"description":"Linked GitHub username"},"cliConnected":{"type":"boolean","description":"Whether this user has ever authenticated a request from the Alien CLI. Latched on first CLI request, never cleared."},"company":{"type":"string","nullable":true,"description":"Company name collected during profile setup."},"acquisitionSource":{"type":"string","nullable":true,"enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other",null],"description":"How the user heard about Alien."},"acquisitionSourceDetail":{"type":"string","nullable":true,"description":"Additional acquisition source detail when the source is other."},"useCases":{"type":"string","nullable":true,"description":"What the user is hoping to use Alien for."},"profileSetupCompletedAt":{"type":"string","format":"date-time","nullable":true,"description":"When the user completed the required profile setup dialog."},"profileSetupVersion":{"type":"integer","nullable":true,"description":"Version of the required profile setup dialog the user completed."}},"required":["id","email","name","image","githubUsername","cliConnected","company","acquisitionSource","acquisitionSourceDetail","useCases","profileSetupCompletedAt","profileSetupVersion"],"additionalProperties":false},"UserProfileSetupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"},"company":{"type":"string","minLength":1,"maxLength":120,"description":"Company name"},"acquisitionSource":{"type":"string","enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other"],"description":"How the user heard about Alien"},"acquisitionSourceDetail":{"type":"string","minLength":1,"maxLength":200,"description":"Required when acquisitionSource is other"},"useCases":{"type":"string","maxLength":2000,"description":"What the user is hoping to use Alien for"}},"required":["name","company","acquisitionSource"],"additionalProperties":false},"GitNamespace":{"type":"object","properties":{"id":{"type":"number","nullable":true},"name":{"type":"string"},"slug":{"type":"string"},"installationId":{"type":"number","nullable":true},"type":{"type":"string","enum":["team","user"]},"provider":{"type":"string","enum":["github"]},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","slug","installationId","type","provider","createdAt"],"additionalProperties":false},"GitRepository":{"type":"object","properties":{"name":{"type":"string"},"private":{"type":"boolean"},"defaultBranch":{"type":"string"},"pushedAt":{"type":"string","format":"date-time"}},"required":["name","private","defaultBranch"],"additionalProperties":false},"AcceptWorkspaceInvitationResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["joined","already-member"]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"workspaceName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["outcome","workspaceId","workspaceName","role"],"additionalProperties":false},"Subject":{"oneOf":[{"$ref":"#/components/schemas/UserSubject"},{"$ref":"#/components/schemas/ServiceAccountSubject"}],"discriminator":{"propertyName":"kind","mapping":{"user":"#/components/schemas/UserSubject","serviceAccount":"#/components/schemas/ServiceAccountSubject"}},"description":"Authenticated principal that can be either a user (with workspace-scoped permissions) or a service account (with configurable scope and role)"},"UserSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["user"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","format":"email","description":"User's email address"},"workspaceId":{"type":"string","description":"ID of the workspace the user is authenticated within"},"workspaceName":{"type":"string","description":"Name of the workspace the user is authenticated within"},"role":{"$ref":"#/components/schemas/UserRole"}},"required":["kind","id","email","workspaceId","role"],"description":"Authenticated user subject with workspace-scoped permissions"},"UserRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"User's role within the workspace","example":"workspace.member"},"ServiceAccountSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["serviceAccount"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique service account identifier (API key ID)"},"workspaceId":{"type":"string","description":"ID of the workspace the service account belongs to"},"workspaceName":{"type":"string","description":"Name of the workspace the service account belongs to"},"scope":{"$ref":"#/components/schemas/SubjectScope"},"role":{"$ref":"#/components/schemas/Role"}},"required":["kind","id","workspaceId","scope","role"],"description":"Authenticated service account subject with scoped permissions (workspace, project, or deployment level)"},"SubjectScope":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["workspace"],"description":"Workspace-scoped access"}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["project"],"description":"Project-scoped access"},"projectId":{"type":"string","description":"ID of the specific project this scope applies to"}},"required":["type","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment"],"description":"Deployment-scoped access"},"deploymentId":{"type":"string","description":"ID of the specific deployment this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"}},"required":["type","deploymentId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"],"description":"Deployment group-scoped access"},"deploymentGroupId":{"type":"string","description":"ID of the specific deployment group this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"}},"required":["type","deploymentGroupId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["manager"],"description":"Manager-scoped access"},"managerId":{"type":"string","description":"ID of the specific manager this scope applies to"}},"required":["type","managerId"]}],"description":"Authorization scope defining what resources this service account can access"},"Role":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"$ref":"#/components/schemas/ProjectRole"},{"$ref":"#/components/schemas/DeploymentRole"},{"$ref":"#/components/schemas/DeploymentGroupRole"},{"$ref":"#/components/schemas/ManagerRole"}],"description":"Role defining what actions this service account can perform within its scope","example":"workspace.member"},"ProjectRole":{"type":"string","enum":["project.viewer","project.developer","project.encryption","project.ai-gateway","project.sandbox-gateway","project.remote-bindings"],"description":"Role for project-scoped service accounts","example":"project.developer"},"DeploymentRole":{"type":"string","enum":["deployment.viewer","deployment.manager","deployment.dynamic-container-manager","deployment.telemetry-writer"],"description":"Role for deployment-scoped service accounts","example":"deployment.manager"},"DeploymentGroupRole":{"type":"string","enum":["deployment-group.deployer"],"description":"Role for deployment group-scoped service accounts","example":"deployment-group.deployer"},"ManagerRole":{"type":"string","enum":["manager.runtime"],"description":"Role for manager-scoped service accounts","example":"manager.runtime"},"ProjectIDOrNamePathParam":{"type":"string","maxLength":100,"description":"Project ID or name."},"Workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name.","example":"my-workspace"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","createdAt"],"additionalProperties":false},"WorkspaceMember":{"type":"object","properties":{"userId":{"type":"string"},"email":{"type":"string"},"name":{"type":"string"},"image":{"type":"string","nullable":true},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"joinedAt":{"type":"string","format":"date-time"}},"required":["userId","email","name","image","role","joinedAt"],"additionalProperties":false},"AgentSettings":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"enabled":{"type":"boolean","description":"Workspace on/off switch for the ai-agent. When `false`, incoming triggers (release/deployment monitoring and Slack-invoked sessions) are rejected before any session runs. Defaults to `true`."},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","enabled","createdAt","updatedAt"],"additionalProperties":false},"UpdateWorkspaceSettingsRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Turn the ai-agent on (`true`) or off (`false`) for this workspace."}}},"WorkspaceInvitation":{"type":"object","properties":{"id":{"type":"string","pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"},"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"status":{"type":"string","enum":["pending","accepted","revoked","expired"]},"deliveryStatus":{"type":"string","enum":["pending","sent","failed"]},"expiresAt":{"type":"string","format":"date-time"},"lastSentAt":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","email","role","status","deliveryStatus","expiresAt","lastSentAt","createdAt","inviteUrl"],"additionalProperties":false},"WorkspaceInviteLink":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"wil_[0-9a-zA-Z]{40}$","description":"Unique identifier for the workspace invite link.","example":"wil_RgcthDSZ37rmFLekuItpFS7btjXoYwou1gE4"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"useCount":{"type":"integer","minimum":0},"lastUsedAt":{"type":"string","format":"date-time","nullable":true},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","role","expiresAt","createdAt","useCount","lastUsedAt","inviteUrl"],"additionalProperties":false},"ProjectListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"deploymentCount":{"type":"number"},"latestRelease":{"$ref":"#/components/schemas/ProjectReleaseInfo"}}}]},"DeploymentPortalAppearancePreset":{"type":"string","enum":["clean","technical","enterprise","playful","minimal"],"default":"clean","description":"Curated visual style for the deployment portal."},"DeploymentPortalAccentColor":{"type":"string","enum":["blue","purple","green","orange","pink","slate"],"default":"blue","description":"Accent color used for highlights and primary actions."},"DeploymentPortalDensity":{"type":"string","enum":["comfortable","compact"],"default":"comfortable","description":"Layout density for portal content."},"ProjectReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","gitMetadata","createdAt"]},"GitMetadata":{"type":"object","nullable":true,"properties":{"commitSha":{"type":"string","nullable":true,"pattern":"^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$","description":"The hash of the commit","example":"dc36199b2234c6586ebe05ec94078a895c707e29"},"commitMessage":{"type":"string","nullable":true,"maxLength":1024,"description":"The commit message","example":"add method to measure Interaction to Next Paint (INP) (#36490)"},"commitRef":{"type":"string","nullable":true,"maxLength":256,"description":"The branch or tag on which the commit was made","example":"main"},"commitDate":{"type":"string","nullable":true,"format":"date-time","description":"The date and time when the commit was created","example":"2026-03-16T12:00:00Z"},"dirty":{"type":"boolean","nullable":true,"description":"Whether or not there have been modifications to the working tree since the latest commit","example":true},"remoteUrl":{"type":"string","nullable":true,"maxLength":2048,"description":"The git repository's remote origin url","example":"https://github.com/alienplatform/alien"},"commitAuthorName":{"type":"string","nullable":true,"maxLength":256,"description":"The name of the author of the commit (from git config)","example":"John Doe"},"commitAuthorEmail":{"type":"string","nullable":true,"maxLength":256,"description":"The author identity recorded by Git. This is not guaranteed to be an RFC-valid email address.","example":"john@example.com"},"commitAuthorLogin":{"type":"string","nullable":true,"maxLength":256,"description":"The provider username of the commit author (e.g., GitHub login), resolved server-side from the commit email","example":"johndoe"},"commitAuthorAvatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"The avatar URL of the commit author, resolved server-side from the provider login","example":"https://github.com/johndoe.png"},"provider":{"$ref":"#/components/schemas/GitProvider"}}},"GitProvider":{"oneOf":[{"$ref":"#/components/schemas/GitHubProvider"},{"$ref":"#/components/schemas/GitLabProvider"},{"nullable":true}],"description":"Provider-specific repository information, resolved server-side from remoteUrl"},"GitHubProvider":{"type":"object","properties":{"type":{"type":"string","enum":["github"]},"org":{"type":"string","maxLength":256,"description":"Repository owner (user or organization)"},"repo":{"type":"string","maxLength":256,"description":"Repository name"}},"required":["type","org","repo"]},"GitLabProvider":{"type":"object","properties":{"type":{"type":"string","enum":["gitlab"]},"namespace":{"type":"string","maxLength":256,"description":"Group/project namespace"},"project":{"type":"string","maxLength":256,"description":"Project name"}},"required":["type","namespace","project"]},"Project":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"projectCapabilities":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"default":null,"required":["schemaVersion","capabilities"],"additionalProperties":false,"description":"Capabilities this Project may offer through setup links."},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","createdAt","workspaceId"]},"ProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","redirectUris"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"hasClientSecret":{"type":"boolean","enum":[true]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","clientId","hasClientSecret","redirectUris"]}]},"GcpOAuthClientId":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[a-zA-Z0-9_-]+-[a-zA-Z0-9_-]+\\.apps\\.googleusercontent\\.com$","description":"Google OAuth web client ID.","example":"1234567890-abc123.apps.googleusercontent.com"},"UpdateProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId"]}]},"GcpOAuthClientSecret":{"type":"string","minLength":1,"maxLength":512,"description":"Google OAuth web client secret. Write-only; never returned by the API.","example":"GOCSPX-example"},"UpdateProject":{"type":"object","properties":{"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"packagesConfigPatch":{"type":"object","properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"additionalProperties":false},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"additionalProperties":false},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"additionalProperties":false},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","nullable":true,"properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"additionalProperties":false}},"additionalProperties":false}},"additionalProperties":false}}},"DeploymentPortalDomainResponse":{"type":"object","properties":{"deploymentPortalEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"},"packageEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["deploymentPortalEndpoint","packageEndpoint"]},"DomainEndpoint":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dend_[0-9a-z]{28}$","description":"Unique identifier for the domain endpoint.","example":"dend_1bb6gdvm1bs74acqkjstcgv"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domainId":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"kind":{"$ref":"#/components/schemas/DomainEndpointKind"},"owner":{"$ref":"#/components/schemas/DomainEndpointOwner"},"hostname":{"type":"string","minLength":1,"maxLength":253},"status":{"$ref":"#/components/schemas/DomainEndpointStatus"},"provider":{"type":"string","nullable":true},"providerState":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"managedDnsRecords":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentPortalManagedDnsRecord"}},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"retryAttempts":{"type":"integer","minimum":0},"nextStepAfter":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","workspaceId","domainId","kind","owner","hostname","status","managedDnsRecords","retryAttempts","createdAt","updatedAt"]},"DomainEndpointKind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"DomainEndpointOwner":{"type":"object","properties":{"type":{"$ref":"#/components/schemas/DomainEndpointOwnerType"},"id":{"type":"string"}},"required":["type","id"]},"DomainEndpointOwnerType":{"type":"string","enum":["workspace","project","manager"]},"DomainEndpointStatus":{"type":"string","enum":["waiting_for_domain","provisioning","waiting_for_dns","waiting_for_health","active","failed","deleting"]},"DeploymentPortalManagedDnsRecord":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"value":{"type":"string"},"ttl":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true}},"required":["name","type","value"]},"DeploymentLinkSetupResponse":{"type":"object","properties":{"activeRelease":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","nullable":true},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true}},"required":["id","version","stack"]},"supportedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"setupItems":{"type":"array","items":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]}},"visiblePackageTypes":{"type":"array","items":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"}},"visibleSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"setupPackagesStatus":{"type":"string","enum":["preparing","ready","failed"],"description":"Whether at least one complete automated setup package is ready across all selected setup items."}},"required":["activeRelease","supportedPlatforms","setupItems","visiblePackageTypes","visibleSetupMethods","setupPackagesStatus"]},"StackByPlatform":{"type":"object","properties":{"aws":{"nullable":true},"gcp":{"nullable":true},"azure":{"nullable":true},"kubernetes":{"nullable":true},"machines":{"nullable":true},"local":{"nullable":true},"test":{"nullable":true}},"additionalProperties":false},"DeploymentSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform","helm","cli","manual"]},"ConfigureModelsRequest":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"minItems":1,"maxItems":100}},"required":["requirements"],"additionalProperties":false},"ProjectCapabilities":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"required":["schemaVersion","capabilities"],"additionalProperties":false},"AIProviderHeaders":{"type":"object","properties":{"providers":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"headers":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"},"value":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7E]*$"}},"required":["name","value"],"additionalProperties":false},"minItems":1,"maxItems":20}},"required":["provider","headers"],"additionalProperties":false},"maxItems":6}},"required":["providers"],"additionalProperties":false},"CapabilityMaterialization":{"type":"object","properties":{"projectCapabilities":{"$ref":"#/components/schemas/ProjectCapabilities"},"source":{"type":"object","properties":{"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"definitionVersion":{"type":"string"},"releaseId":{"type":"string"}},"required":["definitionId","definitionVersion","releaseId"]},"packages":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation","terraform","sandbox-bundle","gcp-sandbox-image"]},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"]}},"required":["type","status"]}}},"required":["projectCapabilities","source","packages"]},"ConfigureRemoteSandboxRequest":{"type":"object","properties":{"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800},"azureIdleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"additionalProperties":false},"SandboxBaseImageRepository":{"type":"object","properties":{"registryHost":{"type":"string","description":"Manager registry host to `docker login` to and push through."},"repository":{"type":"string","description":"This project's repository under that host."}},"required":["registryHost","repository"]},"ProjectCapabilityOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"configurationStatus":{"type":"string","enum":["valid","invalid"]},"hasAppRemoteSandbox":{"type":"boolean"},"summary":{"type":"object","properties":{"groups":{"type":"integer","minimum":0},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"keys":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"registry":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["groups","capabilities"]},"groups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"keys":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"buckets":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"registry":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"remoteSandbox":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["deploymentGroupId","name","externalId","createdAt","capabilities"]}}},"required":["generatedAt","configurationStatus","hasAppRemoteSandbox","summary","groups"]},"RemoteBindingsExternalAccessResponse":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1},"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","format":"uri"}},"required":["deploymentId","resourceId","accessToken","expiresIn","tokenType","managerUrl"]},"RemoteBindingsExternalAccessRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"capability":{"type":"string","enum":["storage","sandbox"]}},"required":["externalId","capability"],"additionalProperties":false},"RemoteOperatorInstallReceipt":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"renderedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","renderedAt"],"additionalProperties":false},"ObservedRemoteOperatorImageIdentity":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"observedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","observedAt"],"additionalProperties":false},"OperationsCatalogKubernetesPermissions":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsRule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false,"description":"Kubernetes RBAC required to execute this operation. Omitted by older servers and null when the operation declares none."},"OperationsCatalogKubernetesPermissionsRule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsVerb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"OperationsCatalogKubernetesPermissionsVerb":{"type":"string","enum":["get","list","watch","delete","patch"]},"RemoteOperatorPermissionPlugin":{"type":"object","properties":{"name":{"type":"string"},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"permissions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["aws","gcp"]},"kubernetesPermissions":{"type":"object","nullable":true,"properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"}},"required":["apiGroup","resource","verbs","reason"]}}},"required":["rules"]}},"required":["name","permissions"]}}},"required":["name","operations"]},"DeploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments allowed in this deployment group"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","externalId","projectId","workspaceId","createdAt"]},"CreateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments in this deployment group"}},"required":["name","project"]},"EnsureDeploymentGroupByNameRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["name","project"]},"EnsureDeploymentGroupByExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["externalId","name","project"]},"CreateSetupLinkResponse":{"allOf":[{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"},{"type":"object","properties":{"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroup"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"The persisted expiration date for the setup link"}},"required":["deploymentGroup","expiresAt"]}]},"CreateDeploymentGroupTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The API key token"},"deploymentLink":{"type":"string","description":"Formatted deployment link"}},"required":["token","deploymentLink"]},"CreateSetupLinkRequest":{"allOf":[{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"},{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"recoveryDeploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Recover Remote Operator bootstrap values for this exact existing group only if it has no deployments. Serialized with registration; never creates or rebinds a group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"}}}]},"DeploymentSetupConfigInput":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}}},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."}}},"DeploymentSetupMetadata":{"type":"object","additionalProperties":{"nullable":true}},"KubernetesClusterSource":{"type":"string","enum":["create","existing"]},"DeploymentSetupStackSettingsPolicy":{"type":"object","properties":{"defaults":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"allowedDeploymentModels":{"type":"array","items":{"type":"string","enum":["push","pull","airgapped"]}},"allowedNetworkModes":{"type":"array","items":{"type":"string","enum":["none","create","default","byo"]}},"allowedUpdatesModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required"]}},"allowedTelemetryModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required","off"]}},"allowedHeartbeatsModes":{"type":"array","items":{"type":"string","enum":["on","off"]}},"allowExternalBindings":{"type":"boolean"},"allowCustomRegistry":{"type":"boolean"}}},"EnvironmentVariableConfig":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"value":{"type":"string","maxLength":10000,"description":"Variable value (encrypted in database)"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","value","type","targetResources"]},"EnvironmentVariableType":{"type":"string","enum":["plain","secret"],"description":"Variable type (plain or secret)"},"DeploymentSetupItemSelection":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":{"type":"boolean"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"Deprecated request shorthand. Use deploymentSetupConfig.policy.allowedAIProviders."}},"required":["item","required"],"additionalProperties":false},"SetupLinkEntryPoint":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"provider":{"oneOf":[{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},{"type":"string","enum":["aws","gcp","azure"]}]}},"required":["item"],"additionalProperties":false,"description":"Portal destination to open first. This controls navigation, not authorization."},"StackInputValuesRequest":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{}},"StackInputValueRequest":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"type":"string"}}]},"ProjectIDOrNameQueryParam":{"type":"string","maxLength":100,"description":"Filter by project ID or name."},"SetDeploymentGroupExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"]},"UpdateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"maxDeployments":{"type":"integer","minimum":1,"description":"Maximum number of deployments in this deployment group"}}},"CreateDeploymentGroupTokenRequest":{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}}},"CreateFirstPartyDeploymentSessionResponse":{"type":"object","properties":{"token":{"type":"string","description":"The deployment-group session token"}},"required":["token"]},"ExternalAIBindingState":{"type":"object","properties":{"binding":{"$ref":"#/components/schemas/ExternalAIBinding"}},"required":["binding"]},"ExternalAIBinding":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"providerClientId":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialRevision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogProviderModelIds":{"type":"array","nullable":true,"items":{"type":"string"}},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"},"requiredModelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"available":{"type":"boolean","nullable":true},"accessStatus":{"type":"string","nullable":true,"enum":["verified","denied",null]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","available","accessStatus","accessObservedAt"]}},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","provider","providerEndpoint","providerClientId","keyFingerprint","credentialRevision","credentialStatus","credentialCheckedAt","catalogProviderModelIds","catalogObservedAt","requiredModelCoverage","updatedAt"]},"PutExternalAIBindingRequest":{"oneOf":[{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","openai"]},"apiKey":{"type":"string","minLength":1,"maxLength":512},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","apiKey","acknowledgeAlienCredentialAccess"],"additionalProperties":false},{"type":"object","properties":{"provider":{"type":"string","enum":["databricks"]},"workspaceUrl":{"type":"string","minLength":1,"maxLength":512},"clientId":{"type":"string","minLength":1,"maxLength":512},"clientSecret":{"type":"string","minLength":1,"maxLength":4096},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","workspaceUrl","clientId","clientSecret","acknowledgeAlienCredentialAccess"],"additionalProperties":false}]},"ExternalAIModelCheck":{"type":"object","properties":{"id":{"type":"string"},"publicModel":{"type":"string"},"status":{"type":"string","enum":["pending","running","verified","denied","failed","cancelled"]},"blockerCode":{"type":"string","nullable":true},"error":{"nullable":true},"requestedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","publicModel","status","blockerCode","requestedAt","completedAt"]},"ContainerRegistryState":{"type":"object","properties":{"route":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]},"endpoint":{"type":"object","nullable":true,"properties":{"url":{"type":"string","format":"uri"},"source":{"type":"string","enum":["runtime","custom-domain"]}},"required":["url","source"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]}}},"required":["route","endpoint","repositories","credentials"]},"CreateContainerRegistryCredentialResponse":{"type":"object","properties":{"credential":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]},"username":{"type":"string","enum":["alien"]},"password":{"type":"string"}},"required":["credential","username","password"]},"Package":{"type":"object","properties":{"id":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"type":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string","description":"Package version (e.g., '1.0.0', 'rel_abc123')"},"sourceReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release used as package build input. Null for release-less packages such as Operate Operator images.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"dependsOnPackageId":{"type":"string","nullable":true,"pattern":"pkg_[0-9a-z]{28}$","description":"Exact package dependency used as build input. Helm packages use this to identify the Operator image embedded in the chart.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"setupFingerprints":{"$ref":"#/components/schemas/SetupFingerprintMap"},"packageBuildInputHash":{"type":"string","description":"Hash of Platform-known package build request inputs: package type, source release, setup fingerprints, package config, and setup contract version"},"config":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"}},"required":["displayName","name"],"description":"Branding configuration for the deploy CLI binary."},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package paired with managed Kubernetes setup artifacts.\n\nThis is derived by the platform and is independent from the generic dependency, which\ncan point at a sandbox bundle for a mixed AWS and Kubernetes release."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for CloudFormation packages"},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image the agent binary is read from."},"baseImage":{"type":"string","description":"`custom_image` resolved to its linux/amd64 manifest, `registry/repository@sha256:...`."},"customImage":{"type":"string","description":"The developer's image as typed, which ties the package to the capability that asked."},"managerUrl":{"type":"string","description":"URL of the GCP manager whose registry proxy receives the push."}},"required":["agentImage","baseImage","customImage","managerUrl"],"description":"Configuration for a GCP sandbox image package.\n\nThe image is the developer's base with the sandbox agent and its contract layered on, pushed\ninto the project's path of the GCP manager's registry."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"managerUrl":{"type":"string","description":"Resolved default management endpoint captured when this build was queued."},"operationPermissions":{"type":"array","nullable":true,"items":{"type":"object","properties":{"operation":{"type":"string","description":"Operation name within the plugin."},"permissions":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Kubernetes API group. An empty string denotes the core API."},"reason":{"type":"string","description":"Human-readable reason the operation requires this rule."},"resource":{"type":"string","description":"Plural Kubernetes resource, optionally with a supported subresource."},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Optional concrete resource names. Empty means all names in the installation scope."},"verbs":{"type":"array","items":{"type":"string"},"description":"Concrete Kubernetes API verbs required by the operation."}},"required":["apiGroup","reason","resource","verbs"],"description":"One Kubernetes API requirement declared by an enabled operation."},"description":"Explicit Kubernetes API requirements."},"schemaVersion":{"type":"integer","minimum":0,"description":"Schema version of the validated permission declaration."}},"required":["rules","schemaVersion"],"description":"Versioned Kubernetes API requirements declared by an enabled operation."},"plugin":{"type":"string","description":"Operations plugin name."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier of an enabled operation in a Helm build snapshot."}},"required":["operation","permissions","plugin","tier"],"description":"Canonical Kubernetes permission snapshot for one enabled operation."},"description":"Canonical Kubernetes permissions for the operations enabled when this build was queued.\n\nThis is derived by the platform and persisted with the build request. It is not part of\nthe user-authored project package configuration. `None` identifies an older package row\nthat must be re-enqueued; an empty `Some` is a reviewed snapshot with no extra grants."},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","description":"Existing namespace claim instead of creating a new claim."},"size":{"type":"string","description":"Requested claim capacity, for example 1Gi."},"storageClassName":{"type":"string","description":"Cluster storage class; empty uses the cluster default."}},"required":["enabled","existingClaim","size","storageClassName"],"description":"Operator identity storage in the generated chart. This does not install a storage driver."},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","description":"Data key inside the Secret."},"name":{"type":"string","description":"Fixed Kubernetes Secret name expected by the workload's Secret mount."},"prefix":{"type":"string","description":"Plaintext prefix before the random alphanumeric suffix."},"randomLength":{"type":"integer","minimum":0,"description":"Length of the random suffix."}},"required":["key","name","prefix","randomLength"],"description":"Non-secret configuration for a chart-generated enrollment token."},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Empty string for the core Kubernetes API group."},"resources":{"type":"array","items":{"type":"string"},"description":"Kubernetes plural resource names; wildcards are not accepted."}},"required":["apiGroup","resources"],"description":"Resource family the chart grants get/list/watch over."},"description":"Exact API groups and resources. Verbs are fixed to get/list/watch."},"serviceAccountProfile":{"type":"string","description":"Permission profile used by the workload Container and generated ServiceAccount."}},"required":["rules","serviceAccountProfile"],"description":"Cluster reads granted to a workload identity, separate from Operator permissions."}},"required":["tokenSecret","workloadReadAccess"],"description":"Kubernetes resources created by the product chart before the runtime starts."}},"required":["chartName","description"],"description":"Configuration for the Helm chart package"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"}},"required":["displayName","name"],"description":"Branding configuration for the Operator image."},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image copied into the bundle."},"baseImage":{"type":"string","description":"The base container image the sandbox filesystem starts from. A release-pushed image\narrives resolved onto the private registry template with its {region} token intact."},"objectKey":{"type":"string","description":"Object key the bundle is written under in every regional bundle store."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store must receive this bundle. Part of the build input hash,\nso a newly supported region re-mints the bundle instead of silently missing it."}},"required":["agentImage","baseImage","objectKey"],"description":"Configuration for a sandbox bundle package.\n\nThe bundle is a zip holding one Dockerfile that layers the published Alien sandbox agent\nonto the vendor's base image; everything the builder writes is derived from these fields."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package used to compose managed Kubernetes modules.\n\nThis is derived by the platform and persisted with the build request. It is separate\nfrom the generic package dependency because a mixed AWS and Kubernetes release can also\ndepend on a sandbox bundle."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for Terraform package generation."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]}],"description":"Type-specific configuration"},"outputs":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"digest":{"type":"string","description":"Image digest (e.g., \"sha256:abc123...\")"},"image":{"type":"string","description":"Full image reference (e.g., \"public.ecr.aws/acme/operators/project-id:1.2.3\")"},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain packaged into the Operator image, if whitelabeled."}},"required":["digest","image"],"description":"Outputs from an Operator image package build"},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentDigest":{"type":"string","description":"Manifest digest of the linux/amd64 agent image the agent binary came from."},"baseDigest":{"type":"string","description":"Manifest digest of the linux/amd64 base the image was built from."},"digest":{"type":"string","description":"Manifest digest of the pushed image."},"image":{"type":"string","description":"Native registry reference pinned by digest, the value a GCP sandbox stack names."},"reuseKey":{"type":"string","description":"Hash of the base digest, the agent image reference and the image contract; equal keys reuse."}},"required":["agentDigest","baseDigest","digest","image","reuseKey"],"description":"Outputs from a GCP sandbox image package build."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"bundleUriTemplate":{"type":"string","description":"Bundle URI with the {region} token in the bucket, resolved by the deploy-time emitters."},"objectKey":{"type":"string","description":"Object key the bundle was written under in every regional bundle store."},"regions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store received this bundle."},"sha256":{"type":"string","description":"SHA256 checksum of the region-neutral bundle zip; a region-templated base image makes\neach regional object differ from it only in the rendered region."},"size":{"type":"integer","minimum":0,"description":"Region-neutral bundle zip size in bytes."}},"required":["bundleUriTemplate","objectKey","regions","sha256","size"],"description":"Outputs from a sandbox bundle package build."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]},{"nullable":true}],"description":"Package outputs (only when status is 'ready')"},"error":{"nullable":true,"description":"Error information if status is 'failed'"},"sourceBinarySha256":{"type":"string","nullable":true,"description":"Builder-recorded source binary SHA256 (for cli/terraform packages)"},"retries":{"type":"integer","minimum":0,"description":"Number of build retries"},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"leaseExpiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Expiration of the current builder lease"},"buildPhase":{"type":"string","nullable":true,"enum":["building","publishing",null],"description":"Coarse package build phase"},"lastProgressAt":{"type":"string","format":"date-time","nullable":true,"description":"Last successful builder lease renewal or phase change"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","projectId","workspaceId","type","status","version","setupFingerprints","packageBuildInputHash","config","retries","createdAt","updatedAt"]},"SetupFingerprintMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/SetupFingerprintInfo"},"description":"Per-target setup compatibility fingerprints copied from the source release"},"SetupFingerprintInfo":{"type":"object","properties":{"target":{"$ref":"#/components/schemas/SetupTarget"},"fingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"version":{"$ref":"#/components/schemas/SetupFingerprintVersion"}},"required":["target","fingerprint","version"]},"SetupTarget":{"type":"string","minLength":1,"description":"Stable target key for the setup contract, e.g. aws/us-east-1"},"SetupFingerprint":{"type":"string","minLength":1,"description":"Deterministic setup contract fingerprint for one setup target"},"SetupFingerprintVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup fingerprint algorithm version"},"ReleaseListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Release"},{"type":"object","properties":{"currentChannels":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannelName"},"description":"Channels for which this release is currently selected"},"commitUrl":{"type":"string","nullable":true,"format":"uri","description":"Validated canonical provider URL for the exact commit"},"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"rollout":{"type":"object","nullable":true,"properties":{"updatedCount":{"type":"integer","description":"Deployments that finished updating to this release (excludes initial provisions)"},"pendingCount":{"type":"integer","description":"Deployments currently targeting this release but not yet running it"},"avgDurationMs":{"type":"number","nullable":true,"description":"Average time from release creation until a deployment finished updating, in milliseconds"}},"required":["updatedCount","pendingCount","avgDurationMs"],"description":"Rollout stats, included when ?include=rollout is used"},"createdBy":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"User ID"},"name":{"type":"string","description":"User's display name"},"email":{"type":"string","description":"User's email address"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"}},"required":["id","name","email","image"],"description":"Platform user who created the release, included when ?include=createdBy is used"}},"required":["currentChannels","commitUrl"]}]},"ReleaseChannelName":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$"},"Release":{"type":"object","properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"projectId":{"type":"string","maxLength":128},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true},"setupFingerprints":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintMap"},{"description":"Per-target setup compatibility fingerprints for this release"}]},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"createdByUserId":{"type":"string","nullable":true,"maxLength":128,"description":"ID of the platform user who created the release, if known"},"workspaceId":{"type":"string","maxLength":128}},"required":["id","projectId","version","createdAt","setupFingerprints","workspaceId"]},"CreateReleaseRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"stack":{"$ref":"#/components/schemas/StackByPlatform"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"channel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Release channel to advance. Defaults to production."}]}},"required":["project"]},"ReleaseAuthorFilterItem":{"type":"object","properties":{"login":{"type":"string","nullable":true,"description":"Provider username (e.g., GitHub login)"},"name":{"type":"string","nullable":true,"description":"Git commit author name"},"avatarUrl":{"type":"string","nullable":true,"format":"uri","description":"Author avatar URL"}},"required":["login","name","avatarUrl"]},"ReleaseDeploymentsResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseDeploymentItem"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"},"stateCounts":{"$ref":"#/components/schemas/ReleaseRolloutStateCounts"}},"required":["items","nextCursor","stateCounts"]},"ReleaseDeploymentItem":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"deploymentGroup":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"],"description":"Deployment group this deployment belongs to"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"rolloutState":{"$ref":"#/components/schemas/ReleaseRolloutState"},"releasedAt":{"type":"string","format":"date-time","nullable":true,"description":"When this release went live on the deployment, null if it never did"},"durationMs":{"type":"integer","nullable":true,"description":"Time from release creation until the deployment finished updating, in milliseconds. Null for initial provisions and deployments that never ran this release."},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"}},"required":["id","name","status","platform","rolloutState","releasedAt","durationMs"]},"ReleaseRolloutState":{"type":"string","enum":["updated","updating","failed","pending","pinned-other","superseded","on-other"]},"ReleaseRolloutStateCounts":{"type":"object","properties":{"updated":{"type":"integer"},"updating":{"type":"integer"},"failed":{"type":"integer"},"pending":{"type":"integer"},"pinned-other":{"type":"integer"},"superseded":{"type":"integer"},"on-other":{"type":"integer"}},"required":["updated","updating","failed","pending","pinned-other","superseded","on-other"],"description":"Deployment counts per rollout state across all deployments the filters allow (ignores the state filter)"},"ReleaseChannel":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"deploymentCount":{"type":"integer","minimum":0},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","projectId","name","currentReleaseId","createdAt","updatedAt"]},"DeploymentListItemResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if in a failed state"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"$ref":"#/components/schemas/ManagerID"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentProtocolVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"DeploymentState protocol version owned by the runtime/manager"},"DeploymentPurpose":{"type":"string","enum":["application","encryption","ai","storage","container-registry","sandbox"],"description":"Operational purpose of this deployment within its customer environment."},"OperatorCapabilityReport":{"type":"object","properties":{"key":{"type":"string","minLength":1,"maxLength":128},"state":{"$ref":"#/components/schemas/OperatorCapabilityState"},"detail":{"type":"string","nullable":true,"maxLength":512}},"required":["key","state"]},"OperatorCapabilityState":{"type":"string","enum":["granted","denied","unavailable"]},"ManagerID":{"type":"string","pattern":"mgr_[0-9a-z]{28}$","description":"ID of the manager","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"DeploymentReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","minLength":1,"maxLength":256},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","version","createdAt"]},"DeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"]},"DeploymentProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"}},"required":["id","name"]},"DeploymentStats":{"type":"object","properties":{"total":{"type":"number","description":"Total number of deployments matching filters"},"byStatus":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by status (only includes statuses with non-zero counts)"},"byPlatform":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by platform (only includes platforms with non-zero counts)"},"byCurrentRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by currentReleaseId. The empty string key represents deployments with no current release (initial provisioning)."},"byPinnedRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by pinnedReleaseId among deployments that are pinned. Excludes unpinned deployments."},"byOrigin":{"type":"object","properties":{"framework":{"type":"number"},"remoteOperator":{"type":"number"}},"description":"Count of deployments introduced through each deployment path."}},"required":["total","byStatus","byPlatform","byCurrentRelease","byPinnedRelease","byOrigin"]},"DeploymentDetailResponse":{"allOf":[{"$ref":"#/components/schemas/Deployment"},{"type":"object","properties":{"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"},"operatorSync":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dosy_[0-9a-z]{28}$","description":"Unique identifier for the deployment operator sync.","example":"dosy_uxveigz3biyrosqycaqubbr"},"status":{"$ref":"#/components/schemas/DeploymentOperatorSyncStatus"},"stuckReason":{"$ref":"#/components/schemas/DeploymentOperatorSyncStuckReason"},"statusMessage":{"type":"string","nullable":true,"description":"Human-readable explanation of the status"},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash last reported by the Operator"},"missingOperations":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Expected `plugin/operation` names not reported by the Operator (catalog-mismatch only)"},"plugins":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/DeploymentOperatorSyncPlugin"},"description":"Enabled plugins compared with what the Operator last reported loading. Null when the sync fingerprints cannot be read."},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","targetBundleHash","targetSetAt"],"description":"Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments."}}}]},"ReportedOperation":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"name":{"type":"string","minLength":1,"maxLength":128}},"required":["plugin","pluginVersion","name"]},"DeploymentUpdateOperationSummary":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"status":{"$ref":"#/components/schemas/DeploymentUpdateOperationStatus"},"reasons":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentUpdateReason"}},"targetReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"changedKeys":{"type":"array","items":{"type":"string"}},"actionRequired":{"type":"string","nullable":true,"description":"Action needed before this update can execute; the current release remains installed."},"requestedAt":{"type":"string","format":"date-time"},"startedAt":{"type":"string","format":"date-time","nullable":true},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","reasons","targetReleaseId","changedKeys","requestedAt"]},"DeploymentUpdateOperationStatus":{"type":"string","enum":["blocked","queued","applying","succeeded","failed","superseded"]},"DeploymentUpdateReason":{"type":"string","enum":["configuration","redeploy","release"]},"DeploymentOperatorSyncStatus":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"DeploymentOperatorSyncStuckReason":{"type":"string","nullable":true,"enum":["download-failed","sync-stalled","catalog-mismatch",null]},"DeploymentOperatorSyncPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string","description":"Version the Operator should run"},"source":{"type":"string","enum":["builtin","custom"]},"state":{"type":"string","enum":["running","adding","updating","removing"],"description":"What the Operator still has to do for this plugin"},"previousVersion":{"type":"string","nullable":true,"description":"Version the Operator is running now (only while updating)"}},"required":["name","version","source","state"]},"Deployment":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentConnectionInfo":{"type":"object","properties":{"arc":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Manager URL for commands"},"deploymentId":{"type":"string","description":"Deployment ID to use in command requests"}},"required":["url","deploymentId"]},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"publicEndpoints":{"type":"object","additionalProperties":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"protocol":{"type":"string","enum":["http","tcp"]},"host":{"type":"string","minLength":1},"port":{"type":"integer","minimum":1,"maximum":65535},"wildcardHost":{"type":"string"}},"required":["url","protocol","host","port"]},"description":"Public endpoints keyed by endpoint name."}},"required":["type"]},"description":"Deployed resources and their public endpoints"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string"}},"required":["arc","resources","status","platform"]},"CreateDeploymentResponse":{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/Deployment"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Effective deployment model persisted for the deployment."},"token":{"type":"string","description":"Deployment token (only returned when using deployment group token)"}},"required":["deployment","deploymentModel"]},"NewDeploymentRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentGroupId":{"type":"string","description":"Required for workspace/project tokens. Deployment group tokens use their own group automatically."},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Optional manager to assign. If omitted, the project default or system manager is selected."}]},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"environmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"},"description":"Configuration of environment variables for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"Stack settings for deployment customization"},"resourcePrefix":{"$ref":"#/components/schemas/ResourcePrefix"},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method that created the deployment. Defaults to cli."}]},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup method metadata used to guide privileged teardown."}]},"inputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{},"description":"Stack input values provided by the deployment creator."},"operatorScope":{"type":"string","minLength":1,"maxLength":512,"description":"Display-only scope reported by the Operator manifest."},"operatorPermission":{"type":"string","minLength":1,"maxLength":64,"description":"Display-only permission tier reported by the Operator manifest."},"initialDesiredRelease":{"type":"string","enum":["active","none"],"default":"active","description":"Desired-release selection for a new deployment. Use none to register an environment without initially requesting a release; later updates can assign one."},"releaseChannel":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","default":"production","description":"Release channel followed while this deployment is not pinned."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Customer setup item selected from this deployment-group token."},"setupHandoff":{"type":"string","enum":["immediate","await-registration"],"default":"immediate","description":"Use await-registration when CloudFormation will create the infrastructure and register this deployment."}},"required":["name","platform","project"],"additionalProperties":false,"description":"Request schema for creating a new deployment"},"ResourcePrefix":{"type":"string","pattern":"^[a-z](?:[a-z0-9]|-(?=[a-z0-9])){1,38}[a-z0-9]$","description":"Optional physical-name prefix for generated cloud resources. Omit to let the manager generate one."},"ImportDeploymentRequest":{"oneOf":[{"$ref":"#/components/schemas/ForwardImportRequest"},{"$ref":"#/components/schemas/PersistImportedDeploymentRequest"}],"description":"Request schema for importing a deployment from resolved setup infrastructure"},"ForwardImportRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["forward"],"default":"forward"},"project":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user-session callers."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Required for user-session callers. Deployment-group tokens use their own group automatically.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager ID. If omitted, the first suitable manager for the source platform is used."}]},"source":{"$ref":"#/components/schemas/ImportSource"},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Exact item selected from a tailored customer setup link."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["source"]},"ImportSource":{"type":"object","properties":{"deploymentName":{"type":"string","minLength":1,"description":"User-chosen deployment name. Must be unique within the deployment group; the manager returns 409 on collision."},"resourcePrefix":{"allOf":[{"$ref":"#/components/schemas/ResourcePrefix"},{"description":"Stable physical-name prefix used by the setup artifact."}]},"sourceKind":{"$ref":"#/components/schemas/ImportSourceKind"},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup source metadata needed to guide privileged teardown."}]},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release that produced the setup artifact. Defaults to latest.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Cloud platform of the imported stack"},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"region":{"type":"string","description":"Region or location reported by the setup artifact"},"setupTarget":{"allOf":[{"$ref":"#/components/schemas/SetupTarget"},{"description":"Setup target this package was generated for"}]},"setupImportFormatVersion":{"$ref":"#/components/schemas/SetupImportFormatVersion"},"setupFingerprint":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprint"},{"description":"Setup compatibility fingerprint embedded in the package"}]},"setupFingerprintVersion":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintVersion"},{"description":"Setup fingerprint algorithm version embedded in the package"}]},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ImportedResource"},"minItems":1}},"required":["deploymentName","resourcePrefix","platform","region","setupTarget","setupImportFormatVersion","setupFingerprint","setupFingerprintVersion","stackSettings","resources"],"description":"Resolved setup import payload"},"ImportSourceKind":{"type":"string","enum":["cloudformation","terraform","helm"],"description":"Source label for observability only — does not affect import behavior."},"KubernetesBasePlatform":{"type":"string","enum":["aws","gcp","azure"],"description":"Base cloud platform for cloud-backed Kubernetes imports."},"SetupImportFormatVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup import payload format version embedded in the package"},"ImportedResource":{"type":"object","properties":{"id":{"type":"string","description":"Resource id from the active stack"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"importData":{"type":"object","additionalProperties":{"nullable":true},"description":"Resolved typed import payload"}},"required":["id","type","importData"]},"PersistImportedDeploymentRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["persist"]},"name":{"type":"string","minLength":1,"description":"Deployment name. Must be unique within the deployment group."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"stackState":{"nullable":true},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"runtimeMetadata":{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},"scheduleReconciliation":{"type":"boolean","default":false},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"default":"provisioning","description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"currentReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"importSource":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"setupMetadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"setupTarget":{"$ref":"#/components/schemas/SetupTarget"},"setupFingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"setupFingerprintVersion":{"$ref":"#/components/schemas/SetupFingerprintVersion"},"deploymentToken":{"type":"string"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["mode","name","deploymentGroupId","managerId","platform","stackSettings","runtimeMetadata","deploymentProtocolVersion","setupTarget","setupFingerprint","setupFingerprintVersion"]},"SetFirstPartyDeploymentInputsResponse":{"type":"object","properties":{"ok":{"type":"boolean"}},"required":["ok"]},"SetFirstPartyDeploymentInputsRequest":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"releaseChannel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["platform"]},"SetupRegistrationOperationResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"status":{"$ref":"#/components/schemas/SetupRegistrationOperationStatus"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"physicalResourceId":{"type":"string","nullable":true},"result":{"$ref":"#/components/schemas/SetupRegistrationOperationResult"},"error":{"type":"object","nullable":true,"properties":{"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["message","retryable"]}},"required":["id","action","sourceKind","status","deploymentId","physicalResourceId","result","error"]},"SetupRegistrationAction":{"type":"string","enum":["create","update","delete"]},"SetupRegistrationOperationStatus":{"type":"string","enum":["pending","processing","waiting-for-handoff","succeeded","failed","responding","responded"]},"SetupRegistrationOperationResult":{"type":"object","nullable":true,"properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentToken":{"type":"string","nullable":true},"helmValues":{"type":"string","nullable":true}},"required":["deploymentId","deploymentToken","helmValues"]},"CreateSetupRegistrationOperationRequest":{"type":"object","properties":{"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"source":{"allOf":[{"$ref":"#/components/schemas/ImportSource"}],"nullable":true},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":512},"cloudFormation":{"$ref":"#/components/schemas/SetupRegistrationCloudFormationTarget"}},"required":["action","sourceKind"],"additionalProperties":false},"SetupRegistrationCloudFormationTarget":{"type":"object","nullable":true,"properties":{"stackId":{"type":"string","minLength":1},"requestId":{"type":"string","minLength":1},"logicalResourceId":{"type":"string","minLength":1},"responseUrl":{"type":"string","format":"uri"},"physicalResourceId":{"type":"string","nullable":true,"minLength":1},"serviceTimeoutSeconds":{"type":"integer","minimum":60,"maximum":7200,"default":3300}},"required":["stackId","requestId","logicalResourceId","responseUrl"],"additionalProperties":false},"DeleteDeploymentResponse":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]},"message":{"type":"string"}},"required":["action","message"]},"DeleteDeploymentRequest":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]}},"required":["action"]},"PinReleaseRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release ID to pin the deployment to. Set to null to resume its followed channel.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for pinning/unpinning deployment release"},"DeploymentInputsResponse":{"type":"object","properties":{"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"values":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"description":"Current non-secret input values. Secret values are never returned."},"providedInputIds":{"type":"array","items":{"type":"string"},"description":"Input IDs that currently have a value, including redacted secrets."}},"required":["inputs","values","providedInputIds"]},"UpdateDeploymentComputeRequest":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]}}},"UpdateDeploymentInputsResponse":{"allOf":[{"$ref":"#/components/schemas/DeploymentInputsResponse"},{"type":"object","properties":{"runtimeUpdateRequested":{"type":"boolean"},"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["runtimeUpdateRequested","outcome","operation"]}]},"UpdateDeploymentInputsRequest":{"type":"object","properties":{"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"clearInputIds":{"type":"array","items":{"type":"string"},"default":[]}},"additionalProperties":false},"UpdateDeploymentEnvironmentVariablesRequest":{"type":"object","properties":{"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"value":{"type":"string","description":"Variable value"},"type":{"type":"string","enum":["plain","secret"],"description":"Variable type"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources)"}},"required":["name","value","type"]},"description":"Environment variables for the deployment"}},"required":["variables"],"additionalProperties":false,"description":"Request schema for updating deployment environment variables"},"CreateDeploymentTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The generated deployment token (only shown once)"},"deploymentId":{"type":"string","description":"The deployment ID that this token is scoped to"}},"required":["token","deploymentId"]},"CreateDeploymentTokenRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128,"description":"Optional description for the deployment token"},"expiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Optional expiration date for the deployment token"}},"required":["description"]},"DynamicContainerResponse":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"appliedGeneration":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"statusMessage":{"type":"string","nullable":true},"internalServices":{"type":"array","items":{"type":"object","properties":{"internalDns":{"type":"string"},"port":{"type":"integer"}},"required":["internalDns","port"]}},"deleted":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["name","spec","generation","appliedGeneration","status","statusMessage","internalServices","deleted","createdAt","updatedAt"]},"DynamicContainerName":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"DynamicContainerSpec":{"type":"object","properties":{"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"resources":{"type":"object","properties":{"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"}},"required":["cpu","memory"]},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192},"default":{}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]}},"required":["image","resources","replicas","ports"],"additionalProperties":false},"PutDynamicContainerRequest":{"type":"object","properties":{"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}}},"required":["spec"],"additionalProperties":false},"ListDeploymentMachinesResponse":{"type":"object","properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentMachine"}}},"required":["machines"]},"DeploymentMachine":{"type":"object","properties":{"clusterResourceId":{"type":"string"},"machineId":{"type":"string"},"status":{"type":"string"},"capacityGroup":{"type":"string"},"zone":{"type":"string"},"cpu":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"memory":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"storage":{"type":"object","nullable":true,"properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"workloadId":{"type":"string","nullable":true},"workloadName":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true},"schedulingMode":{"type":"string","nullable":true},"state":{"type":"string","nullable":true}},"required":["reason"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"overlayIp":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"horizondVersion":{"type":"string","nullable":true},"networkHealth":{"type":"string","enum":["unknown","healthy","degraded"]},"wireguardMesh":{"type":"object","nullable":true,"properties":{"expectedPeerCount":{"type":"integer","minimum":0},"reachablePeerCount":{"type":"integer","minimum":0},"missingPeerMachineIds":{"type":"array","items":{"type":"string"}}},"required":["expectedPeerCount","reachablePeerCount","missingPeerMachineIds"]},"wireguardMeshObservedAt":{"type":"string","nullable":true},"localOverrides":{"type":"array","items":{"type":"object","properties":{"activeDigest":{"type":"string","nullable":true},"actor":{"type":"string","nullable":true},"baseAssignmentHash":{"type":"string"},"baseDigest":{"type":"string","nullable":true},"candidateDigest":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"failureCategory":{"type":"string","nullable":true},"fallbackDigest":{"type":"string","nullable":true},"forcedStop":{"type":"boolean","nullable":true},"healthySince":{"type":"string","nullable":true},"incidentId":{"type":"string","nullable":true},"lifecycle":{"type":"string"},"phaseStartedAt":{"type":"string","nullable":true},"replicaId":{"type":"string"},"workloadName":{"type":"string"}},"required":["baseAssignmentHash","lifecycle","replicaId","workloadName"]}},"localOverridesObservedAt":{"type":"string","nullable":true},"replicaCount":{"type":"integer"}},"required":["clusterResourceId","machineId","status","capacityGroup","zone","cpu","memory","drainBlockers","drainForce","lastHeartbeat","localOverrides","replicaCount"]},"DeploymentCredentialRotationStatus":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0},"rotation":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}},"required":["deploymentId","revision","rotation"]},"DeploymentCredentialRotation":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"expiresAt":{"type":"string"}},"required":["id","revision","status","expiresAt"]},"DeploymentCredentialRotationValues":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"token":{"type":"string"}},"required":["deploymentId","revision","token"]},"VolumeRestore":{"type":"object","properties":{"id":{"type":"string","pattern":"vrst_[0-9a-z]{28}$","description":"Unique identifier for the volume restore.","example":"vrst_rs1j4dytswpy7wbc819jdcx"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string"},"ordinal":{"type":"integer","minimum":0},"snapshotId":{"type":"string"},"status":{"$ref":"#/components/schemas/VolumeRestoreStatus"},"createdBy":{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Principal that requested the restore"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true},"cancelledAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","deploymentId","resourceId","ordinal","snapshotId","status","createdBy","createdAt","updatedAt","completedAt","cancelledAt"],"description":"A request to replace one replica's persistent volume with a volume made from a snapshot"},"VolumeRestoreStatus":{"type":"string","enum":["pending","completed","cancelled"],"description":"pending: sent to the deployment until the container reports it done. If the restore fails, the container's resource shows the error and the request stays pending: retry the deployment or cancel the request. completed: the container reported the restored volume. cancelled: withdrawn before it completed."},"CreateVolumeRestoreRequest":{"type":"object","properties":{"resourceId":{"type":"string","minLength":1,"maxLength":64,"description":"ID of the container resource that owns the volume"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"snapshotId":{"type":"string","minLength":1,"maxLength":1024,"description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute Engine snapshot name, or an Azure snapshot resource ID"}},"required":["resourceId","ordinal","snapshotId"],"additionalProperties":false},"ListVolumeRestoresResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/VolumeRestore"}}},"required":["items"]},"CreateManagerResponse":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["pending"]},"setupToken":{"type":"string"},"setupTokenId":{"type":"string"},"deploymentLink":{"type":"string"},"setupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"inputValues":{"$ref":"#/components/schemas/EncryptedStackInputValues"},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8,"description":"Immutable setup items and exact sources captured when this setup link is created."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string","enum":["plain","secret"]},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"}}},"required":["name","type","targetResources"]}}},"required":["metadata","policy","environmentVariables"]},"setup":{"oneOf":[{"type":"object","properties":{"method":{"type":"string","enum":["cloudformation"]},"deploymentPortalUrl":{"type":"string"},"launchUrl":{"type":"string"},"templateUrl":{"type":"string"},"stackName":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","launchUrl","templateUrl","stackName","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["google-oauth"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"oauthStartUrl":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","oauthStartUrl","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["terraform"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"providerSource":{"type":"string"},"moduleSource":{"type":"string"},"moduleVersion":{"type":"string"},"moduleInputs":{"type":"object","additionalProperties":{"type":"string"}},"mainTf":{"type":"string"},"tfvars":{"type":"string"},"commands":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","providerSource","moduleSource","moduleInputs","mainTf","tfvars","commands","stackSettings"]}]}},"required":["managerId","setupStatus","setupToken","setupTokenId","deploymentLink","setupConfig","setup"]},"DeploymentSetupPolicy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}},"required":["allowedPlatforms","allowedSetupMethods"]},"EncryptedStackInputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/EncryptedStackInputValue"},"default":{}},"EncryptedStackInputValue":{"type":"object","properties":{"value":{"type":"string","description":"Encrypted JSON-encoded input value."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"]},"secret":{"type":"boolean","description":"Whether the original input is secret."}},"required":["value","kind","secret"]},"NewManagerRequest":{"type":"object","properties":{"name":{"type":"string"},"cloud":{"$ref":"#/components/schemas/PrivateManagerCloud"},"region":{"type":"string","minLength":1,"maxLength":64,"description":"Cloud region for the manager."},"setupMethod":{"$ref":"#/components/schemas/PrivateManagerSetupMethod"},"network":{"type":"string","enum":["create","default"],"description":"Optional network mode for the private-manager setup. Defaults to create for production isolation; default uses the provider default network for faster dev/test setup."},"otlpConfig":{"type":"object","properties":{"logsEndpoint":{"type":"string","format":"uri","description":"External OTLP logs endpoint (e.g. https://api.axiom.co/v1/logs)"},"logsAuthHeader":{"type":"string","description":"Auth header in 'key=value,...' format (e.g. 'authorization=Bearer <token>,x-axiom-dataset=<dataset>')"}},"required":["logsEndpoint","logsAuthHeader"],"description":"Optional external OTLP config for forwarding logs to Axiom, Datadog, etc. Falls back to built-in DeepStore when not set."}},"required":["name","cloud","region"]},"PrivateManagerCloud":{"type":"string","enum":["aws","gcp","azure"],"description":"Cloud where the private manager will be deployed."},"PrivateManagerSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform"],"description":"Optional setup method. Defaults to cloudformation for AWS, google-oauth for GCP, and terraform for Azure."},"ManagerRetryResponse":{"oneOf":[{"allOf":[{"$ref":"#/components/schemas/CreateManagerResponse"},{"type":"object","properties":{"mode":{"type":"string","enum":["setup"]}},"required":["mode"]}]},{"$ref":"#/components/schemas/ManagerRetryDeploymentResponse"}]},"ManagerRetryDeploymentResponse":{"type":"object","properties":{"mode":{"type":"string","enum":["deployment"]},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["provisioning"]},"deploymentId":{"type":"string"},"message":{"type":"string"}},"required":["mode","managerId","setupStatus","deploymentId","message"]},"Manager":{"type":"object","properties":{"id":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for the manager"}]},"name":{"type":"string","description":"Display name of the manager"},"targets":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms this manager can handle"},"cloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where this private manager is deployed"},"region":{"type":"string","nullable":true,"description":"Cloud region selected for this private manager"},"setupStatus":{"type":"string","nullable":true,"enum":["pending","provisioning","active","failed","deleting","deleted",null],"description":"Private manager setup lifecycle status"},"url":{"type":"string","nullable":true,"format":"uri","description":"Manager URL (self-reported via heartbeat). DeepStore endpoints are exposed through this URL (e.g., {url}/v1/logs)"},"managementConfigs":{"$ref":"#/components/schemas/ManagerManagementConfigs"},"isSystem":{"type":"boolean","description":"Whether this is a system manager (Alien-hosted)"},"workspaceId":{"type":"string","description":"The workspace ID (for system managers, this is ALIEN_WORKSPACE_ID)"},"status":{"$ref":"#/components/schemas/ManagerStatus"},"version":{"type":"string","nullable":true,"description":"Manager version (self-reported via heartbeat)"},"metrics":{"type":"object","nullable":true,"properties":{"activeDeployments":{"type":"number","description":"Number of active deployments"},"pendingDeployments":{"type":"number","description":"Number of pending deployments"},"memoryUsageMb":{"type":"number","description":"Memory usage in megabytes"},"cpuUsagePercent":{"type":"number","description":"CPU usage percentage"}},"description":"Runtime metrics (self-reported via heartbeat)"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the manager"},"logsDatabaseId":{"type":"string","nullable":true,"description":"ID of the logs database associated with this manager"},"managedDeploymentCount":{"type":"integer","minimum":0,"description":"Number of deployments currently being managed by this manager"},"defaultProjectCount":{"type":"integer","minimum":0,"description":"Number of projects that select this manager as a default manager"},"createdAt":{"type":"string","format":"date-time","description":"Timestamp when the manager was created"}},"required":["id","name","targets","managementConfigs","isSystem","workspaceId","status","managedDeploymentCount","defaultProjectCount","createdAt"],"description":"Manager schema"},"ManagerManagementConfigs":{"type":"object","properties":{"aws":{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"},"platform":{"type":"string","enum":["aws"]}},"required":["managingRoleArn","platform"]},"gcp":{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"},"platform":{"type":"string","enum":["gcp"]}},"required":["serviceAccountEmail","platform"]},"azure":{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."},"platform":{"type":"string","enum":["azure"]}},"required":["managingTenantId","oidcIssuer","oidcSubject","platform"]},"kubernetes":{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}},"description":"Per-platform management configurations for cross-account access (self-reported via heartbeat)"},"ManagerStatus":{"type":"string","enum":["healthy","degraded","unhealthy","unknown"],"description":"Current health status"},"ManagerDomainBindingResponse":{"type":"object","properties":{"managerDomainBinding":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["managerDomainBinding"]},"UpdateManagerDomainBinding":{"type":"object","properties":{"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"}},"additionalProperties":false},"UpdateManagerRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Optional release ID to update to. If not provided, the active release will be chosen","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for updating a manager to a new release"},"Event":{"type":"object","properties":{"id":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"debugSessionId":{"type":"string","nullable":true,"pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"data":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["LoadingConfiguration"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["Finished"]}},"required":["type"]},{"type":"object","properties":{"stack":{"type":"string","description":"Name of the stack being built"},"type":{"type":"string","enum":["BuildingStack"]}},"required":["stack","type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform being targeted"},"stack":{"type":"string","description":"Name of the stack being checked"},"type":{"type":"string","enum":["RunningPreflights"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"targetTriple":{"type":"string","description":"Target triple for the runtime"},"type":{"type":"string","enum":["DownloadingAlienRuntime"]},"url":{"type":"string","description":"URL being downloaded from"}},"required":["targetTriple","type","url"]},{"type":"object","properties":{"relatedResources":{"type":"array","items":{"type":"string"},"description":"All resource names sharing this build (for deduped container groups)"},"resourceName":{"type":"string","description":"Name of the resource being built"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["BuildingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being built"},"type":{"type":"string","enum":["BuildingImage"]}},"required":["image","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being pushed"},"progress":{"oneOf":[{"type":"object","properties":{"bytesUploaded":{"type":"integer","minimum":0,"description":"Bytes uploaded so far"},"layersUploaded":{"type":"integer","minimum":0,"description":"Number of layers uploaded so far"},"operation":{"type":"string","description":"Current operation being performed"},"totalBytes":{"type":"integer","minimum":0,"description":"Total bytes to upload"},"totalLayers":{"type":"integer","minimum":0,"description":"Total number of layers to upload"}},"required":["bytesUploaded","layersUploaded","operation","totalBytes","totalLayers"],"description":"Progress information for image push operations"},{"nullable":true}]},"type":{"type":"string","enum":["PushingImage"]}},"required":["image","type"]},{"type":"object","properties":{"destination":{"type":"string","nullable":true,"description":"Human-readable destination for pushed images"},"platform":{"type":"string","description":"Target platform"},"stack":{"type":"string","description":"Name of the stack being pushed"},"type":{"type":"string","enum":["PushingStack"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"resourceName":{"type":"string","description":"Name of the resource being pushed"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["PushingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"project":{"type":"string","description":"Project name"},"type":{"type":"string","enum":["CreatingRelease"]}},"required":["project","type"]},{"type":"object","properties":{"language":{"type":"string","description":"Language being compiled (rust, typescript, etc.)"},"progress":{"type":"string","nullable":true,"description":"Current progress/status line from the build output"},"type":{"type":"string","enum":["CompilingCode"]}},"required":["language","type"]},{"type":"object","properties":{"nextState":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},"suggestedDelayMs":{"type":"integer","nullable":true,"minimum":0,"description":"An suggested duration to wait before executing the next step."},"type":{"type":"string","enum":["StackStep"]}},"required":["nextState","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["GeneratingCloudFormationTemplate"]}},"required":["type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform for which the template is being generated"},"type":{"type":"string","enum":["GeneratingTemplate"]}},"required":["platform","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being provisioned"},"releaseId":{"type":"string","description":"ID of the release being deployed to the agent"},"type":{"type":"string","enum":["ProvisioningAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being updated"},"releaseId":{"type":"string","description":"ID of the new release being deployed to the agent"},"type":{"type":"string","enum":["UpdatingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being deleted"},"releaseId":{"type":"string","description":"ID of the release that was running on the agent"},"type":{"type":"string","enum":["DeletingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being debugged"},"debugSessionId":{"type":"string","description":"ID of the debug session"},"type":{"type":"string","enum":["DebuggingAgent"]}},"required":["agentId","debugSessionId","type"]},{"type":"object","properties":{"strategyName":{"type":"string","description":"Name of the deployment strategy being used"},"type":{"type":"string","enum":["PreparingEnvironment"]}},"required":["strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being deployed"},"type":{"type":"string","enum":["DeployingStack"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being tested"},"type":{"type":"string","enum":["RunningTestWorker"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpStack"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpEnvironment"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"platformName":{"type":"string","description":"Name of the platform (e.g., \"AWS\", \"GCP\")"},"type":{"type":"string","enum":["SettingUpPlatformContext"]}},"required":["platformName","type"]},{"type":"object","properties":{"repositoryName":{"type":"string","description":"Name of the docker repository"},"type":{"type":"string","enum":["EnsuringDockerRepository"]}},"required":["repositoryName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeployingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"roleArn":{"type":"string","description":"ARN of the role to assume"},"type":{"type":"string","enum":["AssumingRole"]}},"required":["roleArn","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"type":{"type":"string","enum":["ImportingStackStateFromCloudFormation"]}},"required":["cfnStackName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeletingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"bucketNames":{"type":"array","items":{"type":"string"},"description":"Names of the S3 buckets being emptied"},"type":{"type":"string","enum":["EmptyingBuckets"]}},"required":["bucketNames","type"]},{"type":"object","properties":{"deploymentGroupId":{"type":"string","description":"ID of the deployment group this slot belongs to"},"deploymentId":{"type":"string","description":"ID of the deployment that was created"},"releaseId":{"type":"string","nullable":true,"description":"Initial release the slot was created with, if any"},"type":{"type":"string","enum":["DeploymentCreated"]}},"required":["deploymentGroupId","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously live, if any"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentReleased"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release the platform was trying to deploy, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"phase":{"type":"string","enum":["preflights","provisioning","updating","deleting"],"description":"Phase of a deployment at which a failure occurred.\n\nDerived from the source deployment status: `preflights-failed` →\n`Preflights`, `provisioning-failed` → `Provisioning`, `update-failed` →\n`Updating`, `delete-failed` → `Deleting`.\n`refresh-failed` is modelled separately via `DeploymentDegraded`."},"type":{"type":"string","enum":["DeploymentFailed"]}},"required":["deploymentId","error","phase","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"type":{"type":"string","enum":["DeploymentDegraded"]}},"required":["deploymentId","error","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentRecovered"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment that was deleted"},"type":{"type":"string","enum":["DeploymentDeleted"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Name of the channel that moved"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously current, if any"},"releaseId":{"type":"string","description":"ID of the release that is now current"},"type":{"type":"string","enum":["ReleaseChannelUpdated"]}},"required":["channel","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Newly followed channel"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousChannel":{"type":"string","description":"Previously followed channel"},"type":{"type":"string","enum":["DeploymentReleaseChannelChanged"]}},"required":["channel","deploymentId","previousChannel","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release that the failed attempt was targeting, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousError":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"type":{"type":"string","enum":["DeploymentRetryRequested"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release being redeployed"},"type":{"type":"string","enum":["DeploymentRedeployRequested"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"pinnedReleaseId":{"type":"string","description":"ID of the release that is now pinned"},"previousPinnedReleaseId":{"type":"string","nullable":true,"description":"ID of the previously pinned release, if any"},"type":{"type":"string","enum":["DeploymentReleasePinned"]}},"required":["deploymentId","pinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousPinnedReleaseId":{"type":"string","description":"ID of the release that was previously pinned"},"type":{"type":"string","enum":["DeploymentReleaseUnpinned"]}},"required":["deploymentId","previousPinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"changedKeys":{"type":"array","items":{"type":"string"},"description":"Names of the environment variables that changed (added, removed, or modified)"},"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentEnvironmentUpdated"]}},"required":["changedKeys","deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"ID of the volume restore request"},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore"},"type":{"type":"string","enum":["DeploymentVolumeRestoreRequested"]}},"required":["deploymentId","ordinal","requestId","resourceId","snapshotId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume was to be replaced"},"requestId":{"type":"string","description":"ID of the cancelled volume restore request"},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"type":{"type":"string","enum":["DeploymentVolumeRestoreCancelled"]}},"required":["deploymentId","ordinal","requestId","resourceId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentDeletionRequested"]}},"required":["deploymentId","type"]},{"$ref":"#/components/schemas/DeploymentCredentialRotationEvent"}]},"state":{"oneOf":[{"type":"object","properties":{"failed":{"type":"object","properties":{"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]}},"description":"Event failed with an error"}},"required":["failed"]},{"type":"string","enum":["none"]},{"type":"string","enum":["started"]},{"type":"string","enum":["success"]}],"description":"Represents the state of an event"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","data","state","projectId","createdAt","workspaceId"]},"DeploymentCredentialRotationEvent":{"type":"object","properties":{"type":{"type":"string","enum":["DeploymentCredentialRotation"]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"rotationId":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"previousKeyId":{"type":"string"},"candidateKeyId":{"type":"string"},"actor":{"type":"object","properties":{"kind":{"type":"string","enum":["user","serviceAccount"]},"id":{"type":"string"}},"required":["kind","id"]}},"required":["type","deploymentId","rotationId","revision","status","previousKeyId","candidateKeyId","actor"]},"GenerateManagerTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string","description":"Platform JWT for authenticating with the manager"},"expiresIn":{"type":"number","nullable":true,"description":"Token lifetime in seconds"},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","description":"Manager URL for direct access"},"databaseId":{"type":"string","nullable":true,"description":"Log database ID (null if logs not configured)"},"controlPlaneUrl":{"type":"string","nullable":true,"description":"Log control plane URL (null if logs not configured)"}},"required":["accessToken","expiresIn","tokenType","managerUrl","databaseId","controlPlaneUrl"]},"GenerateManagerTokenRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to scope token access to."}},"required":["project"]},"GenerateManagerBindingTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string"}},"required":["accessToken","expiresIn","tokenType","managerUrl"]},"GenerateManagerBindingTokenRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"kind":{"type":"string","enum":["data","sandbox"],"description":"Binding kind the token resolves. Defaults to the deployment's own kind: sandbox for a sandbox deployment, data otherwise."}},"required":["deploymentId"],"additionalProperties":false},"ResolveManagerGcpOAuthProviderResponse":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId","clientSecret"]}]},"ResolveManagerGcpOAuthProviderRequest":{"type":"object","properties":{"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group bearer token whose project-level OAuth provider should be resolved."},"returnOrigin":{"type":"string","format":"uri","description":"Browser origin that will receive the Google OAuth callback result. Must be a first-party dashboard origin or the active portal origin for the deployment group's project."}},"required":["deploymentGroupToken"]},"ManagerHeartbeatResponse":{"type":"object","properties":{"acknowledged":{"type":"boolean"},"timestamp":{"type":"string"}},"required":["acknowledged","timestamp"]},"ManagerHeartbeatRequest":{"type":"object","properties":{"status":{"type":"string","enum":["healthy","degraded","unhealthy"],"description":"Current health status"},"version":{"type":"string","description":"Manager version"},"url":{"type":"string","format":"uri","description":"Manager public URL (for accessing DeepStore endpoints)"},"managementConfigs":{"allOf":[{"$ref":"#/components/schemas/ManagerManagementConfigs"},{"description":"Per-platform management configurations for cross-account access"}]},"metrics":{"type":"object","properties":{"activeDeployments":{"type":"number"},"pendingDeployments":{"type":"number"},"memoryUsageMb":{"type":"number"},"cpuUsagePercent":{"type":"number"}},"description":"Optional runtime metrics"}},"required":["status","url","managementConfigs"]},"ManagerDeployment":{"type":"object","properties":{"platform":{"type":"string","description":"Platform of the internal deployment"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status of the internal deployment"},"deploymentId":{"type":"string","description":"Internal deployment ID"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Currently deployed private manager release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Target private manager release for an in-progress update","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"error":{"nullable":true,"description":"Latest provision / upgrade / delete error"},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type"},"status":{"type":"string","description":"Resource status"},"outputs":{"type":"object","additionalProperties":{"nullable":true},"description":"Resource outputs"}},"required":["type","status"]},"description":"Simplified stack state resources"},"environmentInfo":{"nullable":true,"description":"Manager environment info"}},"required":["platform","status","deploymentId","resources"]},"ContainerRegistryManagerSnapshot":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"routes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string"},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"routableUpstreamName":{"type":"string","nullable":true},"remoteResourceRevision":{"type":"string"}},"required":["id","logicalName","desiredState","routableUpstreamName","remoteResourceRevision"],"additionalProperties":false}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"secretPrefix":{"type":"string"},"secretDigest":{"type":"string","pattern":"^[0-9a-f]{64}$"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","secretPrefix","secretDigest","scope","repositorySubset","expiresAt","revokedAt"],"additionalProperties":false}}},"required":["id","deploymentId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","repositories","credentials"],"additionalProperties":false}}},"required":["generatedAt","routes"],"additionalProperties":false},"ApplyContainerRegistrySnapshotResponse":{"type":"object","properties":{"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["applying","connected","degraded","revoked"]}},"required":["appliedRevision","status"],"additionalProperties":false},"PrepareOperatorManifestPackageResponse":{"type":"object","properties":{"package":{"$ref":"#/components/schemas/Package"}},"required":["package"]},"PrepareOperatorManifestPackageRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}},"required":["project"],"additionalProperties":false},"RenderOperatorManifestResponse":{"type":"object","properties":{"manifest":{"type":"string","description":"Rendered multi-document Kubernetes manifest"},"applyCommand":{"type":"string","description":"kubectl command for applying the manifest from a file"},"filename":{"type":"string","description":"Suggested local filename"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the manifest"},"imagePending":{"type":"boolean","description":"True when the operator image is still building. The manifest contains a placeholder image (<PENDING_IMAGE>) and must not be applied yet — re-render once the operator-image package is ready to get the real image."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["manifest","applyCommand","filename","managerUrl","imagePending","operatorImage"]},"RenderOperatorManifestRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"format":{"type":"string","enum":["raw","helm"],"default":"raw","description":"raw: a kubectl-applyable manifest for one cluster. helm: a paste-into-your-chart template whose namespace and environment name come from Helm at install time."},"environmentName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Per-environment identity. Required for raw output, ignored for helm.","example":"my-app"},"namespace":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([-a-z0-9]*[a-z0-9])?$","description":"Namespace to observe and install into. Omit for helm to use the release namespace."},"scope":{"type":"string","enum":["namespace","cluster"],"default":"namespace","description":"namespace: a namespaced Role that manages the install namespace. cluster: a ClusterRole that manages every namespace."},"labelSelector":{"type":"string","minLength":1,"maxLength":256,"description":"Optional Kubernetes label selector narrowing what is managed, applied within the scope."},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to use for the Operator image. If omitted, the latest ready operator-image package for the project is used.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group token embedded in the operator Secret"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","default":false},"podLabelKey":{"type":"string","minLength":1,"description":"Existing Pod label key to collect logs from. Set with podLabelValue."},"podLabelValue":{"type":"string","minLength":1,"description":"Existing Pod label value to collect logs from. Set with podLabelKey."}},"description":"Enable the node log collector DaemonSet for raw pod logs."},"stackSettings":{"$ref":"#/components/schemas/StackSettings"}},"required":["project","deploymentGroupToken"],"additionalProperties":false},"StackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"EcsBootstrapWriteCheckRequest":{"type":"object","properties":{"stackName":{"type":"string","pattern":"^[A-Za-z][A-Za-z0-9-]{0,127}$"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"}},"required":["stackName","accountId","region","clusterArn"],"additionalProperties":false},"RenderOperatorEcsCloudFormationResponse":{"type":"object","properties":{"template":{"type":"string","nullable":true,"description":"CloudFormation JSON for an ECS Fargate service, or null while the immutable Operator image is building. The artifact contains no bootstrap credential values."},"filename":{"type":"string","description":"Suggested local CloudFormation filename"},"stackName":{"type":"string","description":"Suggested stack name for this installation"},"deployCommand":{"type":"string","nullable":true,"description":"Local bash/zsh deploy command, or null while the image is building. Before writing a bootstrap secret, it asks Alien to verify the one-time setup token and registration state, then preserves or generates the encryption key and writes both to customer-owned Secrets Manager. Once an Operator has registered from this stack, it reuses the stored secret at its current version and never asks for a token. It passes only the secret ARN and version ID to CloudFormation."},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the task definition"},"image":{"type":"string","description":"Immutable Operator image reference, or <PENDING_IMAGE>"},"imagePending":{"type":"boolean","description":"True until a ready Operator image digest is available. A pending template must not be deployed."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["template","filename","stackName","deployCommand","managerUrl","image","imagePending","operatorImage"]},"RenderOperatorEcsCloudFormationRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"environmentName":{"type":"string","minLength":2,"maxLength":100,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Stable per-environment Remote Operator installation name"},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"},"subnetIds":{"type":"array","items":{"type":"string","pattern":"^subnet-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact subnet ID for an Operator task ENI"},"minItems":1,"maxItems":16},"securityGroupIds":{"type":"array","items":{"type":"string","pattern":"^sg-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact security group ID for an Operator task ENI"},"minItems":1,"maxItems":16},"assignPublicIp":{"type":"string","enum":["DISABLED","ENABLED"],"default":"DISABLED"},"efsFileSystemId":{"type":"string","pattern":"^fs-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS filesystem ID for the Operator identity. Omit it, with efsAccessPointId, to have the stack create retained EFS storage."},"efsAccessPointId":{"type":"string","pattern":"^fsap-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS access point ID (POSIX UID and GID 1000) on efsFileSystemId. Supply it together with efsFileSystemId."},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to pin in the task definition. If omitted, the current project package is prepared or reused.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"s3BucketArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$","description":"Exact ARN of an S3 bucket the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned S3 ceiling. Required when enabled S3 operations need ListBucket or GetObject; the generated role contains only these bucket and object ARNs."},"sqsQueueArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):sqs:[a-z0-9]+(?:-[a-z0-9]+)+:[0-9]{12}:(?:[A-Za-z0-9_-]{1,80}|[A-Za-z0-9_-]{1,75}\\.fifo)$","description":"Exact ARN of an SQS queue the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned SQS ceiling. Required when enabled SQS operations read queue attributes; the generated role contains only these queue ARNs."}},"required":["project","environmentName","accountId","region","clusterArn","subnetIds","securityGroupIds"],"additionalProperties":false},"APIKey":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"},"createdByUser":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"email":{"type":"string"},"image":{"type":"string","nullable":true}},"required":["id","email","image"],"description":"User information associated with the API key"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig","createdByUser"],"description":"API key information"},"APIKeyDeploymentSetupConfig":{"type":"object","nullable":true,"properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/APIKeyDeploymentSetupEnvironmentVariable"}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8}},"required":["metadata","policy","environmentVariables"]},"APIKeyDeploymentSetupEnvironmentVariable":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]},"CreateAPIKeyResponse":{"type":"object","properties":{"apiKey":{"type":"string","description":"The generated API key value (only shown once)"},"keyInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig"]}},"required":["apiKey","keyInfo"],"description":"Response containing the new API key and its metadata"},"CreateAPIKeyRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"scope":{"$ref":"#/components/schemas/Scope"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"required":["description","scope","expiresAt"],"description":"Request schema for creating a new API key"},"Scope":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceScope"},{"$ref":"#/components/schemas/ProjectScope"},{"$ref":"#/components/schemas/DeploymentScope"},{"$ref":"#/components/schemas/DeploymentGroupScope"},{"$ref":"#/components/schemas/ManagerScope"}],"discriminator":{"propertyName":"type","mapping":{"workspace":"#/components/schemas/WorkspaceScope","project":"#/components/schemas/ProjectScope","deployment":"#/components/schemas/DeploymentScope","deployment-group":"#/components/schemas/DeploymentGroupScope","manager":"#/components/schemas/ManagerScope"}},"description":"Scope and role configuration for service accounts"},"WorkspaceScope":{"type":"object","properties":{"type":{"type":"string","enum":["workspace"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["type","role"],"description":"Workspace-scoped configuration"},"ProjectScope":{"type":"object","properties":{"type":{"type":"string","enum":["project"]},"projectId":{"type":"string","description":"ID of the project this is scoped to"},"role":{"$ref":"#/components/schemas/ProjectRole"}},"required":["type","projectId","role"],"description":"Project-scoped configuration"},"DeploymentScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment"]},"deploymentId":{"type":"string","description":"ID of the deployment this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"},"role":{"$ref":"#/components/schemas/DeploymentRole"}},"required":["type","deploymentId","projectId","role"],"description":"Deployment-scoped configuration"},"DeploymentGroupScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"]},"deploymentGroupId":{"type":"string","description":"ID of the deployment group this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"},"role":{"$ref":"#/components/schemas/DeploymentGroupRole"}},"required":["type","deploymentGroupId","projectId","role"],"description":"Deployment group-scoped configuration"},"ManagerScope":{"type":"object","properties":{"type":{"type":"string","enum":["manager"]},"managerId":{"type":"string","description":"ID of the manager this is scoped to"},"role":{"$ref":"#/components/schemas/ManagerRole"}},"required":["type","managerId","role"],"description":"Manager-scoped configuration"},"UpdateAPIKeyRequest":{"type":"object","properties":{"enabled":{"type":"boolean"},"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"deploymentSetupConfig":{"$ref":"#/components/schemas/UpdateDeploymentSetupPolicy"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"description":"Request schema for updating an API key"},"UpdateDeploymentSetupPolicy":{"type":"object","properties":{"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"}},"required":["policy"],"description":"Editable part of a deployment link's setup config. Locked env vars and input values are preserved."},"DeleteAPIKeysRequest":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"minItems":1}},"required":["ids"]},"DomainWithUsage":{"allOf":[{"$ref":"#/components/schemas/Domain"},{"type":"object","properties":{"endpoints":{"type":"array","items":{"$ref":"#/components/schemas/DomainEndpoint"}},"usage":{"type":"object","properties":{"deploymentUrlProjects":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"portalBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true},"hostname":{"type":"string"}},"required":["id","projectId","projectName","hostname"]}},"packageDomains":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"hostname":{"type":"string"}},"required":["id","hostname"]}},"managerBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"managerId":{"type":"string"},"managerName":{"type":"string"},"hostname":{"type":"string"}},"required":["id","managerId","managerName","hostname"]}}},"required":["deploymentUrlProjects","portalBindings","packageDomains","managerBindings"]}},"required":["endpoints","usage"]}]},"Domain":{"type":"object","properties":{"id":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domain":{"type":"string"},"isSystem":{"type":"boolean"},"claimToken":{"type":"string"},"hostedZoneId":{"type":"string","nullable":true},"nameServers":{"type":"array","nullable":true,"items":{"type":"string"}},"status":{"type":"string","enum":["pending-zone-creation","pending-verification","verified","lost-verification","failed","deleting"]},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verifiedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","workspaceId","domain","isSystem","claimToken","status","createdAt","updatedAt"]},"EventListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Event"},{"type":"object","properties":{"releaseCreatedAt":{"type":"string","format":"date-time","nullable":true,"description":"createdAt of the event's referenced release, included when ?include=releaseCreatedAt is used"}}}]},"IncidentListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Incident"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"],"additionalProperties":false},"Incident":{"type":"object","properties":{"id":{"type":"string"},"number":{"type":"integer","minimum":0,"exclusiveMinimum":true},"reference":{"type":"string"},"title":{"type":"string"},"scopeLabel":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true},"sessionStatus":{"type":"string","nullable":true,"enum":["queued","running","halted","complete","error","canceled",null]},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","number","reference","title","scopeLabel","agentSessionId","sessionStatus","projectId","deploymentId","releaseId","createdAt","updatedAt"],"additionalProperties":false},"IncidentResponse":{"type":"object","properties":{"incident":{"$ref":"#/components/schemas/Incident"}},"required":["incident"],"additionalProperties":false},"ListMachinesJoinTokensResponse":{"type":"object","properties":{"tokens":{"type":"array","items":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"}}},"required":["tokens"]},"MachinesJoinTokenSummary":{"type":"object","properties":{"id":{"type":"string"},"createdAt":{"type":"string"},"createdBy":{"type":"string"},"expiresAt":{"type":"string","nullable":true},"maxJoins":{"type":"integer","nullable":true},"joinCount":{"type":"integer"},"lastUsedAt":{"type":"string","nullable":true},"revokedAt":{"type":"string","nullable":true}},"required":["id","createdAt","createdBy","joinCount"]},"CreateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RotateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RevokeMachinesJoinTokenResponse":{"type":"object","properties":{"tokenId":{"type":"string"},"revoked":{"type":"boolean"}},"required":["tokenId","revoked"]},"CancelMachinesMachineDrainResponse":{"type":"object","properties":{"machineId":{"type":"string"},"cancelled":{"type":"boolean"}},"required":["machineId","cancelled"]},"DrainMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"requested":{"type":"boolean"}},"required":["machineId","requested"]},"DrainMachinesMachineRequest":{"type":"object","properties":{"deadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"force":{"type":"boolean"}}},"RemoveMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"removed":{"type":"boolean"}},"required":["machineId","removed"]},"CommandBootstrapResponse":{"type":"object","properties":{"managerUrl":{"type":"string","format":"uri","description":"Current customer-facing manager URL"},"token":{"type":"string","minLength":1,"description":"Short-lived command capability token"},"expiresAt":{"type":"string","format":"date-time","description":"Capability expiry in RFC 3339 format"},"target":{"$ref":"#/components/schemas/CommandReceiverBootstrapTarget"}},"required":["managerUrl","token","expiresAt"]},"CommandReceiverBootstrapTarget":{"type":"object","properties":{"resourceId":{"type":"string"},"resourceType":{"type":"string","enum":["container","daemon"]}},"required":["resourceId","resourceType"],"description":"Resolved target identity; present only for receiver bootstrap"},"CommandBootstrapRequest":{"oneOf":[{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["sender"]}},"required":["deploymentId","role"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["receiver"]},"target":{"type":"string","minLength":1,"maxLength":255}},"required":["deploymentId","role","target"],"additionalProperties":false}]},"CommandListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Command"},{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/CommandDeploymentInfo"},"project":{"$ref":"#/components/schemas/CommandProjectInfo"}}}]},"CommandVerification":{"type":"object","nullable":true,"properties":{"state":{"type":"string","enum":["not-required","pending","verified","failed","skipped"],"description":"Verification outcome of an operation command."},"reason":{"type":"string","nullable":true,"description":"Present for 'failed' and 'skipped'."}},"required":["state","reason"],"description":"Verification outcome of an operation command; null for commands that are not operations"},"CommandDeploymentInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/CommandDeploymentGroupInfo"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"managerId":{"type":"string","description":"Manager ID for obtaining access tokens"},"managerUrl":{"type":"string","nullable":true,"format":"uri","description":"URL of the manager for direct payload access"},"managerName":{"type":"string","nullable":true,"description":"Human-readable name of the manager"},"managerIsSystem":{"type":"boolean","nullable":true,"description":"Whether the manager is Alien-hosted (system)"}},"required":["id","name","managerId"]},"CommandDeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"CommandProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string"}},"required":["id","name"]},"Command":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","description":"Command name (e.g., 'analyze-repository', 'sync-data')"},"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Command states in the Commands protocol lifecycle"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Delivery mode for this command (push/pull), derived from the target at creation time"},"target":{"type":"object","nullable":true,"properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to; null on commands created before target routing"},"attempt":{"type":"number","nullable":true,"description":"Current attempt number"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","nullable":true,"description":"Size of command params in bytes"},"responseSizeBytes":{"type":"number","nullable":true,"description":"Size of command response in bytes"},"createdAt":{"type":"string","format":"date-time","description":"When the command was created"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command was dispatched to the deployment"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command completed"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if command failed"},"accessRequestId":{"type":"string","nullable":true,"description":"The approved access request that authorized this operation command, if one did"},"verification":{"$ref":"#/components/schemas/CommandVerification"},"result":{"nullable":true,"description":"Decoded command result when available"},"resultAvailability":{"type":"string","enum":["available","protected"],"description":"Whether a successful operation result is included or withheld pending explicit confirmation"}},"required":["id","deploymentId","projectId","workspaceId","name","state","deploymentModel","target","attempt","deadline","requestSizeBytes","responseSizeBytes","createdAt","dispatchedAt","completedAt","error","accessRequestId","verification"]},"ListCommandNamesResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}}},"required":["names"]},"ListCommandDeploymentsResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"required":["id","name"]}}},"required":["deployments"]},"CreateCommandResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"projectId":{"type":"string","description":"Project ID (for manager to use in routing)"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"How to dispatch the command"},"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to"},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How the command is delivered to its target"},"operationResultContractPersisted":{"type":"boolean","description":"Whether an operation result contract was stored atomically with this command"}},"required":["id","projectId","deploymentModel","target","deliveryMode","operationResultContractPersisted"]},"CreateCommandRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Target deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":1,"maxLength":255,"description":"Command name (e.g., 'analyze-repository')"},"params":{"nullable":true,"description":"Command parameters for public invocation"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key for public invocation retries. Requires params; use null for a command without arguments. Reuse the same key and identical request to recover the original command for up to 24 hours. Scoped to the workspace, caller, deployment, resolved target, and command name. The first accepted request wins; changed params or deadlines do not create a new command with the same key. Omit for a new invocation without retry protection."},"target":{"type":"string","maxLength":255,"description":"Resource id the command is addressed to. Required when the deployment has more than one command-capable resource."},"initialState":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Initial state (PENDING_UPLOAD if params require upload, PENDING if inline)"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Size of command params in bytes"},"operationResultContract":{"nullable":true,"description":"Opaque operation result contract with an optional accessRequestId binding, forwarded by a manager and persisted atomically before dispatch"}},"required":["deploymentId","name"]},"ResolvedCommandTarget":{"type":"object","properties":{"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Identifies the specific resource a command is addressed to."},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How a command is delivered to its target resource.\n\nThis is a Commands-protocol-specific concept and is intentionally distinct\nfrom `DeploymentModel` (see `stack_settings.rs`), which governs the\ninfrastructure-level push/pull wiring for a deployment. Serialized\nlowercase for consistency with `CommandTargetType`."}},"required":["target","deliveryMode"]},"UpdateCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"New command state"},"attempt":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Current attempt number"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command was dispatched"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}}},"DispatchCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"DispatchCommandRequest":{"type":"object","properties":{"dispatchedAt":{"type":"string","format":"date-time","description":"When the command was dispatched"}},"required":["dispatchedAt"]},"CompleteCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"CompleteCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["SUCCEEDED","FAILED","EXPIRED"],"description":"Terminal state to transition to"},"completedAt":{"type":"string","format":"date-time","description":"When the command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}},"required":["state","completedAt"]},"IncrementCommandAttemptResponse":{"type":"object","properties":{"attempt":{"type":"integer","description":"The attempt number after the increment"}},"required":["attempt"]},"DebugSessionListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DebugSession"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"},"DebugSession":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"owner":{"type":"string","nullable":true,"maxLength":128},"state":{"$ref":"#/components/schemas/DebugSessionState"},"mode":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"provider":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Represents the target cloud platform."},"presignedUrls":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DebugPackagePresignedURLs"}},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","state","mode","presignedUrls","createdAt","expiresAt","deploymentId","projectId","workspaceId"]},"DebugSessionState":{"type":"string","enum":["pending","running","stopping","stopped","expired","failed"]},"DebugPackagePresignedURLs":{"type":"object","properties":{"readUrl":{"type":"string","maxLength":2048,"format":"uri"},"writeUrl":{"type":"string","maxLength":2048,"format":"uri"}},"required":["readUrl","writeUrl"]},"CreateDebugSessionRequest":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Override the generated id. Manager passes the registry session id so logs correlate.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"owner":{"type":"string","nullable":true,"maxLength":128},"expiresAt":{"type":"string","format":"date-time"},"state":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Initial state. Defaults to 'pending'."}]},"accessRequestId":{"type":"string","description":"The caller's own access request whose debug grant authorized this session, for the same deployment."}},"required":["deploymentId","expiresAt"]},"UpdateDebugSessionRequest":{"type":"object","properties":{"state":{"$ref":"#/components/schemas/DebugSessionState"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"expiresAt":{"type":"string","format":"date-time"}}},"DeploymentInfo":{"type":"object","properties":{"setupUpdate":{"type":"object","properties":{"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"releaseId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"}],"nullable":true},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"}],"nullable":true},"setupTarget":{"type":"string","nullable":true},"resourcePrefix":{"type":"string","nullable":true},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["deploymentId","updateOperationId","releaseId","name","platform","setupMethod","setupMetadata","setupTarget","resourcePrefix","stackSettings"]},"tokenType":{"type":"string","enum":["deployment","deployment-group"],"description":"Type of token used to authenticate this request"},"deployment":{"type":"object","properties":{"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["name","platform"],"description":"Deployment details (present when using a deployment-scoped token)"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"pinnedSubdomain":{"type":"string","nullable":true}},"required":["id","name","pinnedSubdomain"],"description":"Deployment group details (present when using a deployment-group token)"},"workspace":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"avatarUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name"]},"project":{"type":"object","properties":{"name":{"type":"string"},"portal":{"type":"object","properties":{"appearance":{"$ref":"#/components/schemas/DeploymentPortalAppearance"}},"required":["appearance"]},"stackSummary":{"type":"object","nullable":true,"properties":{"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms supported by the active release"},"requiresNetwork":{"type":"boolean","description":"Whether the stack contains resources that require cloud VPC networking"},"customerModels":{"type":"boolean","description":"Whether this release offers one remotely accessible AI resource"},"resourceCounts":{"type":"object","properties":{"workers":{"type":"integer","minimum":0},"containers":{"type":"integer","minimum":0},"daemons":{"type":"integer","minimum":0,"description":"Daemon resources that run on managed runtime machines"},"publicHttpsEndpoints":{"type":"integer","minimum":0,"description":"Resources that declare managed public HTTPS endpoint setup"},"externalInfra":{"type":"integer","minimum":0,"description":"Storage, queue, KV, vault, database, or cache resources that Kubernetes needs Terraform to provision"},"total":{"type":"integer","minimum":0}},"required":["workers","containers","publicHttpsEndpoints","externalInfra","total"]},"publicEndpoints":{"type":"array","items":{"type":"object","properties":{"resourceId":{"type":"string"},"endpointName":{"type":"string"},"hostLabel":{"type":"string"},"wildcardSubdomains":{"type":"boolean"}},"required":["resourceId","endpointName","hostLabel","wildcardSubdomains"]},"description":"Public endpoints declared by the active release stack"}},"required":["platforms","requiresNetwork","customerModels","resourceCounts","publicEndpoints"]},"generatedDomain":{"type":"object","nullable":true,"properties":{"domain":{"type":"string"},"isSystem":{"type":"boolean"}},"required":["domain","isSystem"],"description":"Parent domain for generated deployment URLs. Chosen public subdomains are only allowed when isSystem is false."}},"required":["name","portal"]},"packages":{"type":"object","properties":{"ready":{"type":"boolean","description":"True if all enabled packages are ready for deployment"},"cli":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"commandName":{"type":"string","description":"CLI command name to use in install instructions"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},"error":{"nullable":true},"installScripts":{"type":"object","properties":{"windows":{"type":"string","format":"uri"},"mac":{"type":"string","format":"uri"},"linux":{"type":"string","format":"uri"}},"required":["windows","mac","linux"],"description":"Install script URLs for each OS"}},"required":["status","commandName","installScripts"]},"cloudformation":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},"error":{"nullable":true},"mode":{"type":"string","enum":["auto","outputs"]},"launchUrl":{"type":"string","format":"uri","description":"CloudFormation launch URL"},"outputsSchema":{"nullable":true}},"required":["status","mode","launchUrl"]},"terraform":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},"error":{"nullable":true},"providerSource":{"type":"string","description":"Terraform provider source (without https://)"},"moduleSources":{"type":"object","additionalProperties":{"type":"string"},"description":"Terraform module sources by target"},"moduleVersion":{"type":"string"},"managerUrls":{"type":"object","additionalProperties":{"type":"string"},"description":"Manager URLs by Terraform target"}},"required":["status","providerSource","moduleSources","managerUrls"]},"helm":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},"error":{"nullable":true},"chartRef":{"type":"string","description":"OCI chart reference"},"managerUrlOverride":{"type":"string","format":"uri","description":"Management endpoint to supply only when this chart's captured default differs from current installation routing."},"managerFetchExample":{"type":"string"},"localImportExample":{"type":"string"}},"required":["status","chartRef"]}},"required":["ready"]},"installContext":{"type":"object","properties":{"targets":{"type":"object","additionalProperties":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managerUrl":{"type":"string","format":"uri"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"awsManagingAccountId":{"type":"string"}},"required":["platform","managerUrl"]},"description":"Deployment-session install context by Terraform/installer target"}},"required":["targets"]},"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"},"modelAvailabilitySources":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"status":{"type":"string","enum":["current","stale","invalid"]},"availability":{"$ref":"#/components/schemas/AiAvailabilityObservation"}},"required":["deploymentId","resourceId","observedAt","status"]}},"setupItems":{"type":"array","items":{"$ref":"#/components/schemas/SetupItemStatus"}},"setupConfig":{"$ref":"#/components/schemas/DeploymentInfoSetupConfig"},"readiness":{"type":"object","properties":{"status":{"type":"string","enum":["ready","notReady","unknown"]},"checks":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"status":{"type":"string","enum":["passed","failed","warning","unknown"]},"message":{"type":"string"},"checkedAt":{"type":"string"}},"required":["code","status","message","checkedAt"]}}},"required":["status","checks"]}},"required":["tokenType","workspace","project","packages","installContext","supportedRegions","modelAvailabilitySources"]},"DeploymentPortalAppearance":{"type":"object","properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}}},"SupportedCloudRegions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by this Alien environment."},"gcp":{"type":"array","items":{"type":"string"},"description":"GCP regions supported by this Alien environment."},"azure":{"type":"array","items":{"type":"string"},"description":"Azure locations supported by this Alien environment."}},"required":["aws","gcp","azure"]},"AiAvailabilityObservation":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"SetupItemStatus":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false},"status":{"type":"string","enum":["not-started","waiting","applying","verifying","connected","needs-attention","revoked"]},"deploymentIds":{"type":"array","items":{"type":"string"}},"blocker":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]}},"required":["item","source","required","status","deploymentIds"],"additionalProperties":false},"DeploymentInfoSetupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"inputValues":{"type":"array","items":{"$ref":"#/components/schemas/ResolvedStackInputSummary"}}},"required":["metadata","policy","environmentVariables"]},"ResolvedStackInputSummary":{"type":"object","properties":{"id":{"type":"string"},"label":{"type":"string"},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"]}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"provided":{"type":"boolean"}},"required":["id","label","providedBy","required","secret","provided"]},"DeploymentComputePlan":{"type":"object","properties":{"pools":{"type":"array","items":{"type":"object","properties":{"poolId":{"type":"string"},"workloads":{"type":"array","items":{"type":"string"}},"requirements":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"scale":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["fixed"]},"machines":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","machines"]},{"type":"object","properties":{"type":{"type":"string","enum":["autoscale"]},"min":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]},"max":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","min","max"]}]},"selected":{"$ref":"#/components/schemas/ComputePoolSelection"},"recommended":{"$ref":"#/components/schemas/ComputePoolSelection"},"machines":{"type":"array","items":{"type":"object","properties":{"machine":{"type":"string"},"profile":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"recommended":{"type":"boolean"}},"required":["machine","profile","recommended"]}},"errors":{"type":"array","items":{"type":"string"}}},"required":["poolId","workloads","requirements","scale","selected","recommended","machines"]}}},"required":["pools"]},"ComputePoolSelection":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"PreparedDeploymentStack":{"type":"object","properties":{"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"setup":{"$ref":"#/components/schemas/SetupFingerprintInfo"}},"required":["platform","stack","setup"]},"SlackInstallUrlResponse":{"type":"object","properties":{"url":{"type":"string","format":"uri"}},"required":["url"]},"SlackIntegrationStatus":{"type":"object","properties":{"connected":{"type":"boolean"},"slackTeamId":{"type":"string","nullable":true},"slackTeamName":{"type":"string","nullable":true},"installedByUserId":{"type":"string","nullable":true},"installedAt":{"type":"string","nullable":true},"notificationChannelId":{"type":"string","nullable":true}},"required":["connected","slackTeamId","slackTeamName","installedByUserId","installedAt","notificationChannelId"]},"SlackChannelsResponse":{"type":"object","properties":{"channels":{"type":"array","items":{"$ref":"#/components/schemas/SlackChannel"}}},"required":["channels"]},"SlackChannel":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"isMember":{"type":"boolean"}},"required":["id","name","isMember"]},"SlackNotificationChannelResponse":{"type":"object","properties":{"notificationChannelId":{"type":"string","nullable":true},"warning":{"type":"string","nullable":true}},"required":["notificationChannelId","warning"]},"SlackNotificationChannelRequest":{"type":"object","properties":{"channelId":{"type":"string","nullable":true}},"required":["channelId"]},"AgentSessionListResponse":{"type":"object","properties":{"sessions":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionListItem"}}},"required":["sessions"]},"AgentSessionListItem":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"subjectId":{"type":"string"},"subject":{"$ref":"#/components/schemas/AgentSessionSubject"},"status":{"type":"string"},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","triggerType","subjectId","subject","status","createdAt","updatedAt"]},"AgentSessionSubject":{"type":"object","properties":{"deploymentName":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"releaseCommitMessage":{"type":"string","nullable":true},"releaseCommitRef":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true}},"required":["deploymentName","deploymentGroupId","deploymentGroupName","releaseId","releaseCommitMessage","releaseCommitRef","projectId","projectName"]},"AgentSessionDetail":{"allOf":[{"$ref":"#/components/schemas/AgentSessionListItem"},{"type":"object","properties":{"resultText":{"type":"string","nullable":true},"toolNames":{"type":"array","nullable":true,"items":{"type":"string"}},"error":{"type":"string","nullable":true}},"required":["resultText","toolNames","error"]}]},"AgentSessionEventsResponse":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionEvent"}},"latestSeq":{"type":"number"},"hasMore":{"type":"boolean"}},"required":["events","latestSeq","hasMore"]},"AgentSessionEvent":{"oneOf":[{"$ref":"#/components/schemas/AgentSessionStatusEvent"},{"$ref":"#/components/schemas/AgentSessionStepEvent"},{"$ref":"#/components/schemas/AgentSessionToolCallEvent"},{"$ref":"#/components/schemas/AgentSessionToolResultEvent"},{"$ref":"#/components/schemas/AgentSessionMarkdownEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalRequestedEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalGrantedEvent"},{"$ref":"#/components/schemas/AgentSessionRestartedEvent"},{"$ref":"#/components/schemas/AgentSessionEventsTruncatedEvent"}],"discriminator":{"propertyName":"type","mapping":{"status":"#/components/schemas/AgentSessionStatusEvent","step":"#/components/schemas/AgentSessionStepEvent","tool_call":"#/components/schemas/AgentSessionToolCallEvent","tool_result":"#/components/schemas/AgentSessionToolResultEvent","markdown":"#/components/schemas/AgentSessionMarkdownEvent","approval_requested":"#/components/schemas/AgentSessionApprovalRequestedEvent","approval_granted":"#/components/schemas/AgentSessionApprovalGrantedEvent","session_restarted":"#/components/schemas/AgentSessionRestartedEvent","events_truncated":"#/components/schemas/AgentSessionEventsTruncatedEvent"}}},"AgentSessionStatusEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["status"]},"payload":{"type":"object","properties":{"status":{"type":"string"},"error":{"type":"string"}},"required":["status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStepEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["step"]},"payload":{"type":"object","properties":{"stepId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["in_progress","complete","error"]}},"required":["stepId","title","status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolCallEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolResultEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_result"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string","nullable":true},"toolName":{"type":"string","nullable":true},"ok":{"type":"boolean"},"output":{"nullable":true}},"required":["toolCallId","toolName","ok"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionMarkdownEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["markdown"]},"payload":{"type":"object","properties":{"text":{"type":"string"}},"required":["text"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalRequestedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_requested"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["approvalId","toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalGrantedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_granted"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"approvedByUserId":{"type":"string"},"approvedByName":{"type":"string","nullable":true},"source":{"type":"string","enum":["dashboard","slack"]}},"required":["approvalId","approvedByUserId","approvedByName","source"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionRestartedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["session_restarted"]},"payload":{"type":"object","properties":{"reason":{"type":"string"}},"required":["reason"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionEventsTruncatedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["events_truncated"]},"payload":{"type":"object","properties":{"limit":{"type":"number"}},"required":["limit"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStopResponse":{"type":"object","properties":{"jobId":{"type":"string"},"status":{"type":"string"},"canceled":{"type":"boolean"}},"required":["jobId","status","canceled"]},"ListOperationsPluginsResponse":{"type":"object","properties":{"plugins":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPlugin"}},"installations":{"$ref":"#/components/schemas/OperatorInstallationsRollup"}},"required":["plugins","installations"]},"OperationsPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default tier."},"builtin":{"type":"boolean","description":"True for compiled-in plugins, false for custom bundles."},"enabled":{"type":"boolean"},"operations":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPluginOperation"}}},"required":["name","version","tier","builtin","enabled","operations"]},"OperationsPluginOperation":{"type":"object","properties":{"name":{"type":"string","description":"Operation name, unique within the plugin."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier for this operation."},"description":{"type":"string","nullable":true,"description":"Human-readable description."},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for operation parameters when the plugin publishes one."},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for a successful result when the plugin publishes one."},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string"},"pollOperation":{"type":"string"},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string"}},"successField":{"type":"string"},"successValue":{"type":"string"},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"timeoutSeconds":{"type":"integer","minimum":1}},"required":["changes","pollOperation","pollParamsFromResult","successField","successValue","timeoutSeconds"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"requiredPermissions":{"type":"array","items":{"type":"string"},"description":"IDs of permission sets (see alien-permissions) this operation requires. Empty when the operation declares none."},"permissions":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetesPermissions":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["name","tier","description","inputSchema","outputSchema","timeoutSeconds","retries","verification","sensitiveOutput","requiredPermissions","permissions"]},"OperatorInstallationsRollup":{"type":"object","properties":{"total":{"type":"integer","minimum":0,"description":"Total pull-mode installations tracked."},"ready":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["total","ready","syncing","stuck"],"description":"Rollup of this project's pull-mode installations by operations-bundle sync status, reflecting the currently enabled plugin set."},"SetBuiltinOperationsPluginsResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["names","permissionDiff"]},"OperationsPermissionDiff":{"type":"object","properties":{"aws":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change adds."},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change removes from the generated cloud configuration."}},"required":["added","removed"]},"gcp":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}}},"required":["added","removed"]},"kubernetes":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}}},"required":["added","removed"]},"incompleteForPlugins":{"type":"array","items":{"type":"string"},"description":"Previously enabled plugins whose grants could not be read before this change disabled or replaced them. Added and removed grants may be incomplete; inspect existing cloud policies before applying the regenerated configuration."}},"required":["aws","gcp","kubernetes"],"description":"Cloud permission delta versus the previously enabled set."},"OperationsAwsPermissionDiffStatement":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["effect","actions","resources","condition","sources"]},"OperationsPermissionDiffSource":{"type":"object","properties":{"plugin":{"type":"string","description":"Plugin that declared the permission."},"operation":{"type":"string","description":"Operation that declared the permission."},"reason":{"type":"string","description":"Why the operation needs this permission."}},"required":["plugin","operation","reason"]},"OperationsGcpPermissionDiffGrant":{"type":"object","properties":{"permission":{"type":"string"},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"],"description":"Where setup grants the permission: the configured project, or each Cloud Storage bucket the installer lists."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["permission","scope","sources"]},"OperationsKubernetesPermissionDiffGrant":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Empty means every resource name."},"remediationOnly":{"type":"boolean","description":"True for write verbs. The Helm chart renders them only when Operator permission is set to remediation; diagnostics installs omit them."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["apiGroup","resource","verbs","resourceNames","remediationOnly","sources"]},"SetBuiltinOperationsPluginsRequest":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"},"description":"Complete set of built-in plugins to enable."}},"required":["names"],"additionalProperties":false},"OperationsBundleUploadUrlResponse":{"type":"object","properties":{"uploadUrl":{"type":"string","format":"uri","description":"Presigned S3 PUT URL to upload the bundle ZIP to."},"uploadId":{"type":"string","description":"One-time id for this upload. Pass it back verbatim to POST /plugins so the API can validate and snapshot exactly the bytes this call uploaded."},"contentType":{"type":"string","description":"Content-Type header the PUT must send (must match the signature)."}},"required":["uploadUrl","uploadId","contentType"]},"OperationsBundleUploadUrlRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."}},"required":["name"]},"PublishOperationsPluginResponse":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","version","tier","enabled","permissionDiff"]},"PublishOperationsPluginRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."},"version":{"type":"string","minLength":1,"description":"Plugin version."},"uploadId":{"type":"string","minLength":1,"description":"The uploadId returned by POST /plugins/upload-url for the ZIP just uploaded. Identifies the exact S3 object to publish — never derived from name/version, so it can't collide with any other upload."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default risk tier."},"metadata":{"type":"object","properties":{"name":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"default":"destructive"},"binaries":{"oneOf":[{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["amd64"],"additionalProperties":false},{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["arm64"],"additionalProperties":false}]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"description":{"type":"string","nullable":true,"minLength":1},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"paramsSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"permissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"requiredPermissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1,"maximum":4294967295},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string","minLength":1,"description":"Human-readable: what this operation changes."},"pollOperation":{"type":"string","minLength":1,"description":"A read-only operation in the same plugin to poll for success."},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string","minLength":1},"default":{},"description":"Poll operation param name -> field name in the write operation's own result."},"successField":{"type":"string","minLength":1,"description":"Dotted field path in the poll result that signals success."},"successValue":{"type":"string","minLength":1,"description":"The value at successField that means verified."},"retry":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"timeoutSeconds":{"type":"integer","minimum":1,"maximum":4294967295}},"required":["changes","pollOperation","successField","successValue","timeoutSeconds"],"additionalProperties":false},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string","minLength":1},"minItems":1}},"required":["kind","fields"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"],"additionalProperties":false}]},"kubernetesPermissions":{"$ref":"#/components/schemas/KubernetesPermissions"}},"required":["name","permissions"],"additionalProperties":false},"default":[]}},"required":["name","version","binaries"],"additionalProperties":false,"description":"The complete canonical metadata.json from the uploaded bundle."}},"required":["name","version","uploadId","tier","metadata"]},"KubernetesPermissions":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/Rule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false},"Rule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/Verb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"Verb":{"type":"string","enum":["get","list","watch","delete","patch"]},"SetOperationsPluginEnabledResponse":{"type":"object","properties":{"name":{"type":"string"},"builtin":{"type":"boolean"},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","builtin","enabled","permissionDiff"]},"SetOperationsPluginEnabledRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether the plugin is distributed to this project's Operators."},"dryRun":{"type":"boolean","description":"Validate the change and return its permission delta without saving it. Defaults to false."},"expectedPermissionDiff":{"allOf":[{"$ref":"#/components/schemas/OperationsPermissionDiff"},{"description":"The permission delta the caller reviewed, usually from a dry run. When set, the change is rejected with 409 if the current delta differs."}]}},"required":["enabled"]},"OperationsPolicyResponse":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"}},"default":{"type":"string","enum":["auto","manual"],"description":"Decision for commands no rule matches."}},"required":["rules","default"]},"OperationsPolicyRule":{"type":"object","properties":{"pattern":{"type":"string","description":"`plugin/operation`, `plugin/*`, or `*`."},"decision":{"type":"string","enum":["auto","manual"],"description":"auto: run immediately. manual: needs customer approval before running."},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself."}},"required":["pattern","decision"]},"UpdateOperationsPolicyRequest":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"},"description":"The full rule set (replaces the previous one)."}},"required":["rules"]},"InvokeOperationResponse":{"type":"object","properties":{"plugin":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"The operation's declared risk tier (informational)."},"decision":{"type":"string","enum":["auto","manual"],"description":"The approval decision the policy resolved to."},"status":{"type":"string","enum":["dispatched","pending-approval"],"description":"dispatched: auto-approved and running. pending-approval: needs customer sign-off."},"commandId":{"type":"string","description":"The created operation-command id when dispatched (absent when pending)."}},"required":["plugin","operation","tier","decision","status"]},"InvokeOperationRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment to run the operation against."},"plugin":{"type":"string","description":"Plugin name."},"operation":{"type":"string","description":"Operation name exposed by the plugin."},"params":{"nullable":true,"description":"JSON params passed to the operation."},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key used to deduplicate this exact target operation."},"remediationPlanId":{"type":"string","description":"A remediation plan (`plan_…`) whose access request the customer has already approved for this exact command. When set and the plan's access request was created by the caller, is `customer-approved` and lists this `plugin/operation` with these params, the invocation is authorized by that approval and dispatches immediately regardless of the project's operations policy — the customer already signed off on this exact command via the access-request flow, so the project's default `manual` policy (meant for ad-hoc, unreviewed invocations) would otherwise require a second, redundant approval for the same action. Another principal's approved request never authorizes the caller."},"accessRequestId":{"type":"string","description":"A CLI-originated access request (`accessRequest_…`, no remediation plan) the caller created and the customer has already approved covering this exact command — either an exact match or a resolved, frozen wildcard entry. Same bypass semantics as `remediationPlanId`, for requests with no investigation behind them. Set exactly one of `remediationPlanId` or `accessRequestId`, not both. With neither, any approved request the caller created covering this exact command is used."}},"required":["deploymentId","plugin","operation"]},"VerifyOperationCheckResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["verified","not-yet","failed","skipped"],"description":"verified: success condition met. not-yet: keep polling. failed: the poll operation itself reported failure. skipped: the operation has no verification spec, or the write result carries none of the fields verification needs (the caller never opted in for this invocation)."},"reason":{"type":"string","description":"Present for 'failed' and 'skipped'."},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer"},"intervalSeconds":{"type":"integer"}},"required":["maxAttempts","intervalSeconds"],"description":"The operation's declared retry policy, echoed so the caller's poll loop doesn't need its own copy."},"timeoutSeconds":{"type":"integer","description":"The operation's declared verification timeout."}},"required":["outcome"]},"VerifyOperationCheckRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment the original write command ran against."},"commandId":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Original operation command whose stored result and dispatch-time verification contract are authoritative.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"}},"required":["deploymentId","commandId"]},"AccessRequestDebugGrant":{"type":"object","nullable":true,"properties":{"tool":{"$ref":"#/components/schemas/DebugGrantTool"},"namespace":{"type":"string","example":"braintrust"},"cloudScope":{"type":"string","example":"123456789012/prod-readonly"}},"required":["tool"]},"DebugGrantTool":{"type":"string","enum":["kubectl","aws","gcloud","az"]},"AccessRequestStatus":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"CreateAccessRequest":{"type":"object","properties":{"replayKey":{"type":"string","minLength":1,"maxLength":128,"description":"Durable replay key scoped to the authenticated requester and workspace. Reusing it with a different validated payload returns ACCESS_REQUEST_REPLAY_MISMATCH."},"requestedExpiresAt":{"type":"string","format":"date-time","description":"Absolute requester deadline in UTC (Z suffix). Must be in the future and at most six hours ahead (30 seconds clock-skew tolerance). Approvals never extend it. Omit for legacy approval-window behavior."},"deploymentId":{"type":"string"},"remediationPlanId":{"type":"string","description":"Set for a plan-backed (ai-agent) request. Omit for a plan-less (CLI) request."},"title":{"type":"string","description":"Required for a plan-backed request; defaults to the operation/pattern/debug-tool for a plan-less one."},"reason":{"type":"string"},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]},"minItems":1,"description":"Plan-backed only: the exact commands the investigation is requesting."},"operation":{"type":"string","example":"kubernetes/restart-pod","description":"Plan-less, exact request: a single `plugin/operation`."},"operationPattern":{"type":"string","example":"kubernetes/*","description":"Plan-less, wildcard request: `plugin/*`. Requires `maxRisk`."},"params":{"nullable":true,"description":"Params for an exact `operation` request."},"maxRisk":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Required with `operationPattern`: the highest risk tier the wildcard grant may cover."},"debugTool":{"allOf":[{"$ref":"#/components/schemas/DebugGrantTool"},{"description":"Requests a remote-debugging grant for this tool, alongside or instead of an operations grant."}]},"debugNamespace":{"type":"string","example":"braintrust","description":"Scopes a `kubectl` debug grant to one Kubernetes namespace. Requires `debugTool: kubectl`."},"debugCloudScope":{"type":"string","example":"123456789012/prod-readonly","description":"Scopes an `aws`/`gcloud`/`az` debug grant to a customer-meaningful account/project/subscription string. Requires `debugTool` set to that provider."}},"required":["deploymentId"]},"AccessRequestApprovalMethod":{"type":"string","example":"slack"},"AccessRequestActivity":{"type":"object","properties":{"operations":{"type":"array","items":{"type":"object","properties":{"commandId":{"type":"string"},"invocationId":{"type":"string","nullable":true,"description":"The MCP invocation that dispatched the command, when MCP did."},"command":{"type":"string","description":"`plugin/operation`."},"state":{"type":"string"},"createdAt":{"type":"string"},"dispatchedAt":{"type":"string","nullable":true},"completedAt":{"type":"string","nullable":true},"verification":{"$ref":"#/components/schemas/CommandVerification"}},"required":["commandId","invocationId","command","state","createdAt","dispatchedAt","completedAt","verification"]}},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"state":{"$ref":"#/components/schemas/DebugSessionState"},"owner":{"type":"string","nullable":true},"createdAt":{"type":"string"},"expiresAt":{"type":"string"}},"required":["id","state","owner","createdAt","expiresAt"]}}},"required":["operations","debugSessions"]},"RevokeAccessRequest":{"type":"object","properties":{"reason":{"type":"string","maxLength":4096,"description":"Why the grant is withdrawn, for the audit trail."}}},"SyncListResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"userEnvironmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"deploymentToken":{"type":"string","nullable":true},"lockedBy":{"type":"string","nullable":true},"lockedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId","userEnvironmentVariables"]}}},"required":["deployments"],"description":"Full deployment records for manager operation"},"SyncListRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. Manager-scoped tokens are always constrained to their own manager ID."}]},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to include"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment status"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by deployment platform"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Filter by deployment group ID","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"limit":{"type":"integer","minimum":1,"maximum":500,"description":"Maximum records to return"}},"additionalProperties":false,"description":"Request to list full operational deployments"},"SyncAcquireResponseDeployment":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Deployment group ID the deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method recorded on the deployment when it has a setup-owned path."}]},"operationId":{"type":"string","nullable":true,"pattern":"duop_[0-9a-z]{28}$","description":"Immutable target claimed for this execution, or null for observation-only work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","nullable":true,"pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed by this manager session, or null for observation-only work.","example":"duat_uve04tou5eoua3q17dar1pz"},"current":{"$ref":"#/components/schemas/DeploymentState"},"config":{"$ref":"#/components/schemas/DeploymentConfig"}},"required":["deploymentId","projectId","deploymentGroupId","operationId","attemptId","current","config"]},"DeploymentState":{"type":"object","properties":{"currentRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}]},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"protocolVersion":{"type":"integer","minimum":0,"description":"Protocol version for cross-actor compatibility.\nAll actors (manager, push client, agent) check this before stepping.\nMismatched versions produce a clear error instead of silent corruption.\nSee docs/02-manager/10-deployment-protocol.md."},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment\nWhen true and status is a failed state, the deployment system will retry failed resources"},"runtimeMetadata":{"oneOf":[{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},{"nullable":true}]},"stackState":{"oneOf":[{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},{"nullable":true}]},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"targetRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]}},"required":["platform","protocolVersion","status"],"description":"Current deployment state (includes releases)"},"DeploymentConfig":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"volumeRestores":{"type":"array","items":{"type":"object","properties":{"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"Unique ID of this request. A controller performs each request once."},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute\nEngine snapshot name, or an Azure snapshot resource ID"}},"required":["ordinal","requestId","resourceId","snapshotId"],"description":"Replace one replica's persistent volume with a new volume made from a snapshot.\n\nThe controller stops the replica, snapshots the volume it is about to\nreplace (so the restore can be undone), creates the new volume in the same\nzone, starts the replica on it, and deletes the replaced volume."},"description":"Operator requests to replace a replica's persistent volume with a new\nvolume made from a snapshot. A container controller performs each\nrequest once, identified by its `request_id`, and reports it in\n`ContainerOutputs.volumes`."}},"required":["environmentVariables"],"description":"Deployment configuration"},"SyncContextRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the context. Manager-scoped tokens are constrained to their own manager ID."}]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false},"SyncAcquireResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"},"description":"List of acquired deployments with deployment context"},"failures":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment that failed","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"error":{"allOf":[{"$ref":"#/components/schemas/APIError"},{"description":"Error that occurred during context building"}]}},"required":["deploymentId","projectId","error"]},"description":"List of deployments that failed during context building (locks already released)"},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time","description":"When the provisional leases on the returned deployments lapse. Confirm them with sync/renew before starting work. Null when nothing was acquired."}},"required":["deployments","failures","leaseExpiresAt"],"description":"Acquired deployments and failures"},"SyncAcquireRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. If omitted, resolved from each deployment's managerId column."}]},"session":{"type":"string","description":"Unique session identifier for lock tracking"},"requestId":{"type":"string","minLength":1,"description":"Idempotency key for one logical acquire request"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to lock (for Pull model sync)"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment statuses (default: all deployment statuses)"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by platforms (default: all platforms the Manager supports)"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Filter by setup method for setup-owned acquisition paths"}]},"acquireMode":{"type":"string","enum":["runtime","setup-run","setup-teardown"],"description":"Phase ownership mode for deployment acquisition"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model from stackSettings.deploymentModel."},"supportsExecutionClaims":{"type":"boolean","enum":[true],"description":"Signals support for echoing executionClaim on renew, reconcile, and release."},"limit":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of deployments to acquire (default: 10)"}},"required":["session","requestId","deploymentModel"],"additionalProperties":false,"description":"Request to acquire deployments for processing"},"SyncReconcileResponse":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the state was reconciled"},"current":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Current deployment state after reconciliation"}]},"target":{"$ref":"#/components/schemas/TargetDeployment"},"targetOperationsBundleSet":{"$ref":"#/components/schemas/TargetOperationsBundleSet"},"targetDynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"deleted":{"type":"boolean"},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]},"suspendedReason":{"type":"string","maxLength":512}},"required":["name","generation","image","cpu","memory","replicas","ports","deleted","env","secretEnv"]},"description":"Complete release-independent dynamic container target set for a Kubernetes Operator."}},"required":["success","current"],"description":"State reconciliation result with optional target"},"TargetDeployment":{"type":"object","properties":{"config":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"volumeRestores":{"type":"array","items":{"type":"object","properties":{"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"Unique ID of this request. A controller performs each request once."},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute\nEngine snapshot name, or an Azure snapshot resource ID"}},"required":["ordinal","requestId","resourceId","snapshotId"],"description":"Replace one replica's persistent volume with a new volume made from a snapshot.\n\nThe controller stops the replica, snapshots the volume it is about to\nreplace (so the restore can be undone), creates the new volume in the same\nzone, starts the replica on it, and deletes the replaced volume."},"description":"Operator requests to replace a replica's persistent volume with a new\nvolume made from a snapshot. A container controller performs each\nrequest once, identified by its `request_id`, and reports it in\n`ContainerOutputs.volumes`."}},"required":["environmentVariables"],"description":"Deployment configuration\n\nConfiguration for how to perform the deployment.\nNote: Credentials (ClientConfig) are passed separately to step() function."},"releaseInfo":{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."}},"required":["config","releaseInfo"],"description":"Target deployment if update is needed"},"TargetOperationsBundleSet":{"type":"object","properties":{"hash":{"type":"string","minLength":1,"maxLength":256},"bundles":{"type":"array","items":{"$ref":"#/components/schemas/OperationsBundleDownload"}}},"required":["hash","bundles"],"description":"Target operations-bundle set the Operator should converge its loaded plugin registry toward."},"OperationsBundleDownload":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"url":{"type":"string","format":"uri","description":"Presigned URL to GET the bundle ZIP from. Short-lived."}},"required":["plugin","pluginVersion","url"]},"SyncReconcileRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to reconcile state for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Lock session (push model only) - verifies lock ownership"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Immutable operation claimed at acquisition. Required with attemptId for update execution.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed at acquisition. Required with operationId for update execution.","example":"duat_uve04tou5eoua3q17dar1pz"},"state":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Complete deployment state after step() execution"}]},"updateHeartbeat":{"type":"boolean","description":"Update heartbeat timestamp (for successful health checks)"},"suggestedDelayMs":{"type":"integer","minimum":0,"description":"Delay before this deployment should be acquired again."},"resourceHeartbeats":{"type":"array","items":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"description":"Latest typed resource heartbeats collected during this step."},"observedInventoryBatches":{"type":"array","items":{"$ref":"#/components/schemas/ObservedInventoryBatch"},"description":"Observed raw-resource inventory batches read during this step."},"capabilities":{"type":"array","items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Operator-reported runtime capabilities."},"operatorVersion":{"type":"string","minLength":1,"maxLength":128,"description":"Operator binary version reported by the runtime."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorImageIdentity"},"operationsReport":{"$ref":"#/components/schemas/OperationsReport"},"dynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"message":{"type":"string","maxLength":2048}},"required":["name","generation","status"]},"description":"Observed dynamic container generations from a Kubernetes Operator."}},"required":["deploymentId","state"],"additionalProperties":false,"description":"Request to reconcile deployment state"},"ObservedInventoryBatch":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"],"description":"Backend whose observer produced this snapshot."},"complete":{"type":"boolean","description":"Whether this batch is a complete replacement for the scope. Complete\nbatches tombstone previously observed rows in the same scope when they\nare absent from `resources`."},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inventoryScope":{"type":"string","description":"Stable scope for the provider list operation that produced this batch."},"observedAt":{"type":"string","format":"date-time","description":"Time the inventory scope was observed."},"resources":{"type":"array","items":{"type":"object","properties":{"alienResourceId":{"type":"string","nullable":true},"attributes":{"type":"object","properties":{},"additionalProperties":{"nullable":true}},"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"counts":{"oneOf":[{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},{"nullable":true}]},"deploymentId":{"type":"string","nullable":true},"displayName":{"type":"string"},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"images":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."},"description":"Distinct container images the resource's running instances report, when\nthe provider exposes them."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerKind":{"type":"string","description":"Provider-native kind, such as `apps/v1/Deployment`,\n`AWS::S3::Bucket`, `storage.googleapis.com/Bucket`, or an Azure\nresource type."},"providerStale":{"type":"boolean"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"rawIdentity":{"type":"string","description":"Provider-native stable identity: Kubernetes object identity, cloud ARN,\nGCP full resource name, Azure resource id, etc."},"region":{"type":"string","nullable":true},"resourceTypeHint":{"oneOf":[{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},{"nullable":true}]},"scope":{"type":"string","nullable":true},"version":{"type":"string","nullable":true,"description":"Release/version identity observed from the provider resource, when available."}},"required":["displayName","health","lifecycle","partial","providerKind","providerStale","rawIdentity"]}},"sourceKind":{"type":"string","description":"Writer/source for this inventory pass, such as `operator` or\n`manager-observer`."}},"required":["backend","complete","controllerPlatform","inventoryScope","observedAt","resources","sourceKind"]},"RemoteOperatorImageIdentity":{"type":"object","properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"}},"required":["source","packageId","packageVersion","image","digest"],"additionalProperties":false,"description":"Immutable installer receipt self-reported by a running Remote Operator. This is not independent runtime image inspection."},"OperationsReport":{"type":"object","properties":{"loadedBundleHash":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"operations":{"type":"array","items":{"$ref":"#/components/schemas/ReportedOperation"},"default":[]}},"description":"Operations bundle set the Operator currently has loaded, for plugin-sync status tracking."},"SyncRenewRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Single deployment to renew. Deprecated: use deploymentIds. Retained so a manager built against the previous API keeps renewing during rollout.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"minItems":1,"maxItems":100,"description":"Deployments to renew or confirm. Renewal is per deployment: the response reports each one independently."},"claims":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Unique identifier for the deployment update attempt.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","operationId","attemptId"]},"maxItems":100,"description":"Claim identities for deployments currently executing an update."},"session":{"type":"string","minLength":1}},"required":["session"],"additionalProperties":false},"SyncReleaseRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to release","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Session identifier to release"},"mode":{"type":"string","enum":["release","acknowledge-completed"],"description":"Defaults to release. acknowledge-completed discards an exact terminal pull receipt after a lost response; it never releases newer work or grants a live lease."},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Operation returned by acquire. Required when the lease carried update work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Attempt returned by acquire. Required when the lease carried update work.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","session"],"additionalProperties":false,"description":"Request to release deployment lock"},"ResolveResponse":{"type":"object","properties":{"managerId":{"type":"string","description":"Manager ID"},"managerName":{"type":"string","description":"Manager display name"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL"},"managerIsSystem":{"type":"boolean","description":"Whether the manager is Alien-hosted"},"managerCloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where the private manager is hosted. Null for Alien-hosted managers."},"projectId":{"type":"string","description":"Resolved project ID"},"installContext":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}},"required":["platform","managementConfig"],"description":"Target install context derived from platform-managed manager metadata. Present for cloud push platforms."}},"required":["managerId","managerName","managerUrl","managerIsSystem","projectId"]},"CloudRegionsResponse":{"type":"object","properties":{"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"}},"required":["supportedRegions"]},"BillingAuditLogRow":{"type":"object","properties":{"id":{"type":"string"},"workspaceId":{"type":"string","nullable":true},"action":{"type":"string"},"payload":{"nullable":true},"createdAt":{"type":"string"}},"required":["id","workspaceId","action","createdAt"]},"WorkspaceBillingEntitlements":{"type":"object","properties":{"planId":{"$ref":"#/components/schemas/PlanId"},"planStatus":{"$ref":"#/components/schemas/BillingPlanStatus"},"features":{"$ref":"#/components/schemas/BillingFeatureFlags"},"limits":{"$ref":"#/components/schemas/BillingLimits"},"syncedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"}},"required":["planId","planStatus","features","limits","syncedAt","stale"]},"PlanId":{"type":"string","enum":["starter","pro","pro_annual","enterprise"]},"BillingPlanStatus":{"type":"string","enum":["active","trialing","past_due","canceled","none"]},"BillingFeatureFlags":{"type":"object","properties":{"custom_domains":{"type":"boolean"},"private_managers":{"type":"boolean"},"operations_custom_plugins":{"type":"boolean"},"sso_saml":{"type":"boolean"},"audit_logs":{"type":"boolean"},"airgapped":{"type":"boolean"}},"required":["custom_domains","private_managers","operations_custom_plugins","sso_saml","audit_logs","airgapped"]},"BillingLimits":{"type":"object","properties":{"maxDeployments":{"type":"number","nullable":true},"maxProjects":{"type":"number","nullable":true},"maxSeats":{"type":"number","nullable":true},"maxCustomDomains":{"type":"number","nullable":true},"creditUsd":{"type":"number","nullable":true},"seatsIncluded":{"type":"number","nullable":true}},"required":["maxDeployments","maxProjects","maxSeats","maxCustomDomains","creditUsd","seatsIncluded"]},"WorkspaceGatewayOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"summary":{"type":"object","properties":{"totalProjects":{"type":"integer","minimum":0},"gatewayProjects":{"type":"integer","minimum":0},"activeProjects":{"type":"integer","minimum":0},"setupInProgressProjects":{"type":"integer","minimum":0},"needsAttentionProjects":{"type":"integer","minimum":0},"connectedCustomers":{"type":"integer","minimum":0}},"required":["totalProjects","gatewayProjects","activeProjects","setupInProgressProjects","needsAttentionProjects","connectedCustomers"]},"projects":{"type":"array","items":{"$ref":"#/components/schemas/GatewayProjectOverview"}}},"required":["generatedAt","summary","projects"]},"GatewayProjectOverview":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"state":{"$ref":"#/components/schemas/GatewayProjectState"},"connectedCustomers":{"type":"integer","minimum":0},"settingUpCustomers":{"type":"integer","minimum":0},"needsAttentionCustomers":{"type":"integer","minimum":0},"revokedCustomers":{"type":"integer","minimum":0}},"required":["id","name","state","connectedCustomers","settingUpCustomers","needsAttentionCustomers","revokedCustomers"]},"GatewayProjectState":{"type":"string","enum":["not-set-up","setup-in-progress","active","needs-attention"]},"GatewayKind":{"type":"string","enum":["ai","encryption","sandbox"],"description":"Alien Gateway a customer deployment runs","example":"ai"}},"parameters":{}},"paths":{"/v1/invitations/{token}":{"get":{"operationId":"getWorkspaceInvitationPreview","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation preview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitationPreview"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/memberships":{"get":{"operationId":"listMemberships","description":"List all workspaces the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listMemberships","responses":{"200":{"description":"List of user's workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Membership"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile":{"get":{"operationId":"getUserProfile","description":"Get the current user's profile and user-scoped onboarding state.","x-speakeasy-group":"user","x-speakeasy-name-override":"getProfile","responses":{"200":{"description":"User profile.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateUserProfile","description":"Update the current user's profile (display name).","x-speakeasy-group":"user","x-speakeasy-name-override":"updateProfile","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"}}}}}},"responses":{"200":{"description":"Profile updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile/setup":{"post":{"operationId":"completeUserProfileSetup","description":"Complete the required beta intake and profile setup dialog.","x-speakeasy-group":"user","x-speakeasy-name-override":"completeProfileSetup","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfileSetupRequest"}}}},"responses":{"200":{"description":"Profile setup completed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/workspaces":{"post":{"operationId":"createWorkspace","description":"Create a new workspace. The current user will be automatically added as an admin.","x-speakeasy-group":"user","x-speakeasy-name-override":"createWorkspace","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name"},"logoUrl":{"type":"string","format":"uri","description":"Optional workspace logo URL"}},"required":["name"]}}}},"responses":{"201":{"description":"Created workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Membership"}}}},"400":{"description":"Bad request - invalid workspace name.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Workspace name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces":{"get":{"operationId":"listGitNamespaces","description":"List all git namespaces (GitHub installations) the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaces","parameters":[{"schema":{"type":"string","enum":["github"],"default":"github"},"required":false,"name":"provider","in":"query"}],"responses":{"200":{"description":"List of user's git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/sync":{"post":{"operationId":"syncGitNamespaces","description":"Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.","x-speakeasy-group":"user","x-speakeasy-name-override":"syncGitNamespaces","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github"],"description":"Git provider to sync"}},"required":["provider"]}}}},"responses":{"200":{"description":"Synced git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/{id}/repositories":{"get":{"operationId":"listGitNamespaceRepositories","description":"List repositories accessible through a git namespace (GitHub installation).","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaceRepositories","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","description":"Search query to filter repositories by name"},"required":false,"description":"Search query to filter repositories by name","name":"search","in":"query"}],"responses":{"200":{"description":"List of repositories.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitRepository"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Git namespace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/pending":{"get":{"operationId":"getPendingWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"required":true,"name":"workspace","in":"query"}],"responses":{"200":{"description":"An active invitation addressed to the signed-in user for this workspace, if any.","content":{"application/json":{"schema":{"type":"object","properties":{"invitationId":{"type":"string","nullable":true,"pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"}},"required":["invitationId"]}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/{token}/accept":{"post":{"operationId":"acceptWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptWorkspaceInvitationResponse"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/whoami":{"get":{"operationId":"whoami","description":"Get the current authenticated principal (user or service account). Works with both session cookies and API keys.","x-speakeasy-group":"auth","x-speakeasy-name-override":"whoami","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","example":"my-workspace"},"required":false,"description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current authenticated principal.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Subject"}}}},"400":{"description":"Missing required workspace for user credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export":{"get":{"operationId":"getProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Configuration and delivery status; headers are never returned.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string","maxLength":2048,"format":"uri"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}}},"required":["endpoint","enabled"]}}}},"responses":{"200":{"description":"Saved configuration. Changes take effect within 30 seconds.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export/test":{"post":{"operationId":"testProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Result of sending one test log to the saved destination.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}":{"get":{"operationId":"getLogExportDeliveryConfig","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"responses":{"200":{"description":"Private runtime configuration for the assigned manager.","content":{"application/json":{"schema":{"type":"object","nullable":true,"properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}},"revision":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}},"required":["endpoint","enabled","headers","revision","updatedAt"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}/status":{"post":{"operationId":"reportLogExportDelivery","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"revision":{"type":"string"},"succeeded":{"type":"boolean"},"error":{"type":"string","nullable":true,"enum":["timeout","connection","destination-rejected","invalid-destination","overflow",null]},"statusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599}},"required":["revision","succeeded","error"]}}}},"responses":{"200":{"description":"Delivery status recorded for the current configuration revision.","content":{"application/json":{"schema":{"type":"object","properties":{"accepted":{"type":"boolean"}},"required":["accepted"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces":{"get":{"operationId":"listWorkspaces","description":"Retrieve all workspaces.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search workspaces by name"},"required":false,"description":"Search workspaces by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Workspace"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}":{"get":{"operationId":"getWorkspace","description":"Retrieve a workspace by ID.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspace","description":"Update a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"}}}}}},"responses":{"200":{"description":"Workspace updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteWorkspace","description":"Delete a workspace. The workspace must have no projects.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Workspace deleted successfully."},"400":{"description":"Workspace still has projects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members":{"get":{"operationId":"listWorkspaceMembers","description":"List all members of a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"listMembers","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"List of workspace members.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceMember"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"addWorkspaceMember","description":"Add a member to a workspace by email. The user must already have an account.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"addMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email","description":"Email of the user to add"},"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"Role to assign"}]}},"required":["email","role"]}}}},"responses":{"201":{"description":"Member added successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"404":{"description":"Workspace or user not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"User is already a member.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members/{userId}":{"patch":{"operationId":"updateWorkspaceMember","description":"Update a workspace member's role.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"New role to assign"}]}},"required":["role"]}}}},"responses":{"200":{"description":"Member role updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"400":{"description":"Cannot remove last admin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"removeWorkspaceMember","description":"Remove a member from a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"removeMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Member removed successfully."},"400":{"description":"Cannot remove last admin or self.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/settings":{"get":{"operationId":"getWorkspaceSettings","description":"Read the ai-agent settings for a workspace. Returns defaults (`enabled: true`) when the workspace has never customized them.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"getSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspaceSettings","description":"Update the ai-agent settings for a workspace. Supports `enabled` (`false` turns the ai-agent off so incoming triggers are rejected before any session runs).","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkspaceSettingsRequest"}}}},"responses":{"200":{"description":"Updated ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations":{"get":{"operationId":"listWorkspaceInvitations","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Pending invitations.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceInvitation"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["email","role"]}}}},"responses":{"201":{"description":"Invitation created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"403":{"description":"Seat limit reached.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}/resend":{"post":{"operationId":"resendWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Invitation email sent again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}":{"delete":{"operationId":"revokeWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invitation revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invite-link":{"get":{"operationId":"getWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Active invite link.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"createWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["role"]}}}},"responses":{"200":{"description":"Invite link created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invite link revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects":{"get":{"operationId":"listProjects","description":"Retrieve all projects.","x-speakeasy-group":"projects","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search projects by name"},"required":false,"description":"Search projects by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deploymentCount","latestRelease"]},"description":"Optional fields to include: deploymentCount, latestRelease"},"required":false,"description":"Optional fields to include: deploymentCount, latestRelease","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved projects.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createProject","description":"Create a new project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"enabledCapabilities":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"minItems":1,"maxItems":5}},"required":["name"]}}}},"responses":{"201":{"description":"Project created successfully.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"}}}]}}}},"400":{"description":"Invalid request or GitHub repository connection failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}":{"get":{"operationId":"getProject","description":"Retrieve a project by ID or name.","x-speakeasy-group":"projects","x-speakeasy-name-override":"get","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateProject","description":"Update a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"update","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProject"}}}},"responses":{"200":{"description":"Project updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"403":{"description":"Project update permission is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this project's release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request or package settings are invalid or incomplete.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteProject","description":"Delete a project. The project must have no deployments.","x-speakeasy-group":"projects","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Project deleted successfully."},"400":{"description":"Project still has deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/gcp-oauth-provider":{"get":{"operationId":"getProjectGcpOAuthProvider","description":"Retrieve redacted project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectGcpOAuthProvider","description":"Update project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"updateGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProjectGcpOAuthProvider"}}}},"responses":{"200":{"description":"Google Cloud OAuth provider settings updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"400":{"description":"Invalid provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/source":{"post":{"operationId":"configureProjectSource","description":"Connect a GitHub repository or Alien template to an existing project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureSource","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["repository"]},"gitRepository":{"type":"object","properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","gitRepository"]},{"type":"object","properties":{"mode":{"type":"string","enum":["template"]},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","targetNamespace","templatePath"]}]}}}},"responses":{"200":{"description":"Project source connected.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}}}]}}}},"400":{"description":"Repository or template configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Template fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-portal-domain":{"get":{"operationId":"getProjectDeploymentPortalDomain","description":"Get the deployment portal domain binding for a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentPortalDomain","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment portal domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentPortalDomainResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/import-template":{"post":{"operationId":"createProjectFromTemplate","description":"Create a project by forking alienplatform/alien into your namespace.","x-speakeasy-group":"projects","x-speakeasy-name-override":"createFromTemplate","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$","description":"GitHub owner namespace (user or organization) that will receive the fork"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"}},"required":["name","targetNamespace","templatePath"]}}}},"responses":{"201":{"description":"Project created successfully from template.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}},"required":["template"]}]}}}},"400":{"description":"Bad request or GitHub integration not installed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/template-urls":{"get":{"operationId":"getProjectTemplateUrls","description":"Get template URLs for deploying setup stacks in this project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getTemplateUrls","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Template URLs retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"aws":{"type":"object","nullable":true,"properties":{"templateUrl":{"type":"string","format":"uri","description":"URL to download the CloudFormation template"},"launchStackUrl":{"type":"string","format":"uri","description":"URL to launch the template in the AWS CloudFormation console"}},"required":["templateUrl","launchStackUrl"],"description":"Template URLs for deploying an AWS setup stack"}}}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-link-setup":{"get":{"operationId":"getProjectDeploymentLinkSetup","description":"Get the active release stack and portal-visible setup availability for deployment-link configuration.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentLinkSetup","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment-link setup retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentLinkSetupResponse"}}}},"400":{"description":"The project's sandbox follows an Alien default image this environment does not configure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or active release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/active-release":{"get":{"operationId":"getProjectActiveRelease","description":"Get the production channel's current release. When deploymentId is provided, returns that deployment's effective release: its pin, or its followed channel's current release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getActiveRelease","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Optional deployment ID to check for pinned release"},"required":false,"description":"Optional deployment ID to check for pinned release","name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Effective release retrieved successfully.","content":{"application/json":{"schema":{"nullable":true}}}},"404":{"description":"Project or effective release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models/impact":{"post":{"operationId":"previewProjectModelsImpact","description":"Preview which customer model connections a configuration change may affect.","x-speakeasy-group":"projects","x-speakeasy-name-override":"previewModelsImpact","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Model configuration impact.","content":{"application/json":{"schema":{"type":"object","properties":{"connectedCustomers":{"type":"integer","minimum":0},"affectedCustomers":{"type":"integer","minimum":0},"verificationNeeded":{"type":"integer","minimum":0},"affected":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"provider":{"type":"string"},"reason":{"type":"string","enum":["provider-no-longer-compatible","required-model-not-in-catalog"]}},"required":["deploymentGroupId","name","externalId","provider","reason"]}},"truncated":{"type":"boolean"}},"required":["connectedCustomers","affectedCustomers","verificationNeeded","affected","truncated"]}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities":{"put":{"operationId":"setProjectCapabilities","description":"Set the capabilities offered by a Project. Removing a capability prevents new setup without deleting existing customer resources.","x-speakeasy-group":"projects","x-speakeasy-name-override":"setCapabilities","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"maxItems":5}},"required":["enabled"],"additionalProperties":false}}}},"responses":{"200":{"description":"The Project's enabled capabilities.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/deployments":{"put":{"operationId":"configureProjectDeployments","description":"Enable deployments for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureDeployments","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled","methods"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployments enabled for the Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-provider-headers":{"get":{"operationId":"getProjectAiProviderHeaders","description":"Get static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Static AI provider headers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"configureProjectAiProviderHeaders","description":"Replace the static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"responses":{"200":{"description":"Static AI provider headers updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"400":{"description":"Provider header configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models":{"put":{"operationId":"configureProjectModels","description":"Configure customer-owned model providers without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureModels","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Customer Models configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/keys":{"put":{"operationId":"configureProjectKeys","description":"Enable customer-owned application encryption without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["applicationEncryption"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Key configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/buckets":{"put":{"operationId":"configureProjectBuckets","description":"Enable buckets without requiring a project Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureBuckets","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"access":{"type":"string","enum":["read-write"]}},"required":["access"],"additionalProperties":false}}}},"responses":{"200":{"description":"Buckets configured and their exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/registry":{"put":{"operationId":"configureProjectRegistry","description":"Enable customer-owned container registries without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRegistry","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["repositories","credentialPolicy"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Registry configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox":{"put":{"operationId":"configureProjectRemoteSandbox","description":"Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRemoteSandbox","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureRemoteSandboxRequest"}}}},"responses":{"200":{"description":"Sandbox configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"400":{"description":"The sandbox configuration cannot be satisfied by this environment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The request body is invalid, including a per-cloud field.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The image's registry or Alien's GCP image service could not be reached, or the save's GCP image could not be queued; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox/base-image-repository":{"post":{"operationId":"ensureProjectSandboxBaseImageRepository","description":"Ensure the project's private image repository exists and return where to push a private sandbox base image. Name the pushed image as the remote sandbox base image afterwards.","x-speakeasy-group":"projects","x-speakeasy-name-override":"ensureSandboxBaseImageRepository","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Repository ready to receive a push.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SandboxBaseImageRepository"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found, or no AWS manager serves it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager could not prepare the repository.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The project's manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/overview":{"get":{"operationId":"getProjectCapabilityOverview","description":"Get safe, server-derived capability status for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getCapabilityOverview","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Project capability overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilityOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-bindings/access":{"post":{"operationId":"createRemoteBindingsExternalAccess","tags":["remote-bindings"],"summary":"Create short-lived Remote Bindings access for a external resource","description":"Selects a connected external resource by Project and external ID, then returns a short-lived deployment-scoped Manager capability. The caller never receives the external cloud credentials from Platform.","x-speakeasy-group":"remoteBindings","x-speakeasy-name-override":"createExternalAccess","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessRequest"}}}},"responses":{"200":{"description":"Short-lived Remote Bindings access was created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessResponse"}}}},"401":{"description":"The API key is missing, invalid, expired, or disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot access Remote Bindings for this Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The Project or external ID was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"More than one active external resource matched.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The external resource or its assigned Manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary":{"get":{"operationId":"getRemoteOperatorProjectSummary","tags":["projects"],"summary":"Get the authoritative Remote Operator project summary","x-speakeasy-group":"projects","x-speakeasy-name-override":"getRemoteOperatorSummary","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Authoritative Remote Operator state composed from existing owners.","content":{"application/json":{"schema":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"nextAction":{"type":"object","properties":{"kind":{"type":"string","enum":["connect","inspect","reconnect","verify","update","wait","none"]},"target":{"type":"string","enum":["setup","deployment","releases","access","operations","activity"]},"deploymentId":{"type":"string","nullable":true},"message":{"type":"string"}},"required":["kind","target","deploymentId","message"]},"installations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroupId":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs","unknown"]},"region":{"type":"string","nullable":true},"state":{"type":"string","enum":["unhealthy","stale","connecting","unverified","verified"]},"stateReason":{"type":"string"},"status":{"type":"string"},"lastHeartbeatAt":{"type":"string","nullable":true,"format":"date-time"},"lastSuccessfulDiagnosticAt":{"type":"string","nullable":true,"format":"date-time"},"operatorVersion":{"type":"string","nullable":true},"operatorScope":{"type":"string","nullable":true},"operatorPermission":{"type":"string","nullable":true},"expectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"previousExpectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"runningImage":{"$ref":"#/components/schemas/ObservedRemoteOperatorImageIdentity"},"imageStatus":{"type":"string","enum":["matching","drifted","unreported","unconfigured"]},"operatorUpdate":{"type":"object","nullable":true,"properties":{"packageId":{"type":"string"},"packageVersion":{"type":"string"},"image":{"type":"string"},"digest":{"type":"string"},"builtAt":{"type":"string","format":"date-time"}},"required":["packageId","packageVersion","image","digest","builtAt"],"description":"The ready Operator image selected by the project's current configuration when it differs from the image this installation was set up with. Re-applying setup installs it. Null when the installation already uses it, its install identity is unknown, or the selected package is not ready."},"operationSync":{"type":"object","nullable":true,"properties":{"status":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"string","nullable":true}},"required":["status","targetBundleHash","observedBundleHash","targetSetAt","observedAt","error"]},"application":{"type":"object","properties":{"state":{"type":"string","enum":["no-desired","up-to-date","update-required","unknown","failed"],"description":"How the application release the Operator reports compares with the desired release. Alien never applies the change; the customer applies it through their own release process."},"reason":{"type":"string"},"reported":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The application release the Operator reports"},"desired":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["channel","pin"]},"helmChart":{"type":"object","nullable":true,"properties":{"chart":{"type":"string"},"version":{"type":"string"}},"required":["chart","version"],"description":"The Helm chart built for this release, when the release has one"},"images":{"type":"array","items":{"type":"string"},"description":"Container images the release records for AWS, in resource order"}},"required":["releaseId","version","source","helmChart","images"],"description":"The release the deployment should run: its pinned release or its channel's release"},"releaseChannel":{"type":"string","description":"The release channel the deployment follows when unpinned"},"rollback":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The release the deployment reported before it moved to the desired release"}},"required":["state","reason","reported","desired","releaseChannel","rollback"]},"permissions":{"type":"object","properties":{"status":{"type":"string","enum":["current","outdated","unknown"],"description":"Whether the Kubernetes RBAC and cloud IAM recorded for this installation match the permissions compiled from the currently enabled operations."},"recordedAt":{"type":"string","nullable":true,"format":"date-time","description":"When setup was issued or last re-applied; null when nothing was recorded."},"reason":{"type":"string"}},"required":["status","recordedAt","reason"],"description":"Installed cloud and Kubernetes permissions. Setup applies them, so enabling or disabling operations changes them only after the installation's setup is re-applied."}},"required":["id","name","deploymentGroupId","platform","region","state","stateReason","status","lastHeartbeatAt","lastSuccessfulDiagnosticAt","operatorVersion","operatorScope","operatorPermission","expectedImage","previousExpectedImage","runningImage","imageStatus","operatorUpdate","operationSync","application","permissions"]}},"unregisteredSetups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs"]},"createdAt":{"type":"string","format":"date-time"},"valuesExpireAt":{"type":"string","nullable":true,"format":"date-time","description":"When the newest installation values stop working. Resuming setup can replace them."}},"required":["deploymentGroupId","name","platform","createdAt","valuesExpireAt"]},"description":"Setups whose installation values were created but whose Operator never registered, newest first."}},"required":["items","unregisteredSetups"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"release":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"reported":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"deployments":{"type":"integer","minimum":0,"exclusiveMinimum":true},"latest":{"type":"boolean"}},"required":["releaseId","version","createdAt","deployments","latest"]},"description":"Application releases that Remote Operator deployments report, newest first. The newest reported release is latest."},"older":{"type":"integer","minimum":0,"description":"Deployments without a desired release that report a release older than the latest reported release"},"unknown":{"type":"integer","minimum":0,"description":"Deployments that report no application release"},"rollout":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"upToDate":{"type":"integer","minimum":0},"waiting":{"type":"integer","minimum":0},"unknown":{"type":"integer","minimum":0},"failed":{"type":"integer","minimum":0}},"required":["releaseId","version","upToDate","waiting","unknown","failed"]},"description":"Desired releases, most deployments first, with how many Remote Operator deployments run each one, still need the change, report no release, or failed after it"}},"required":["reported","older","unknown","rollout"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"access":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"pending":{"type":"integer","minimum":0},"active":{"type":"integer","minimum":0},"recent":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"approvedUntil":{"type":"string","nullable":true,"format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","title","status","approvedUntil","updatedAt"]}}},"required":["pending","active","recent"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"operations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"selected":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["builtin","custom"]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]}},"required":["name","tier"]}}},"required":["name","version","source","operations"]}},"sync":{"type":"object","properties":{"preparing":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"ready":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["preparing","syncing","ready","stuck"]},"generatedPermissions":{"type":"array","items":{"type":"object","properties":{"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]},"cloud":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetes":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["plugin","pluginVersion","operation","tier","cloud"]}}},"required":["selected","sync","generatedPermissions"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"activity":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"recent":{"type":"array","items":{"type":"object","properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string","nullable":true},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","nullable":true},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt"]}},"investigations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"deploymentId":{"type":"string"},"status":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","triggerType","deploymentId","status","createdAt","updatedAt"]},"description":"Recent agent sessions about Remote Operator deployments or their access requests"},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"state":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","state","createdAt","expiresAt"]}},"lastVerifiedOperation":{"type":"object","nullable":true,"properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string"},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","enum":["SUCCEEDED"]},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verification":{"type":"object","properties":{"state":{"type":"string","enum":["not-required","verified","skipped"]},"attempts":{"type":"integer","minimum":0},"maxAttempts":{"type":"integer","minimum":0},"deadline":{"type":"string","nullable":true,"format":"date-time"},"reason":{"type":"string","nullable":true}},"required":["state","attempts","maxAttempts","deadline","reason"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"resultAvailable":{"type":"boolean"},"result":{"nullable":true},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt","verification","sensitiveOutput","resultAvailable","completedAt"]}},"required":["recent","investigations","debugSessions","lastVerifiedOperation"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]}},"required":["generatedAt","project","nextAction","installations","release","access","operations","activity"]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-image":{"post":{"operationId":"acceptRemoteOperatorImage","tags":["projects"],"summary":"Accept a reported image for a Remote Operator installation","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorImage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"responses":{"200":{"description":"The observed immutable image is now the accepted desired image.","content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"400":{"description":"The deployment is not a Remote Operator installation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The requested image is not the image in the latest Operator heartbeat.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-permissions":{"post":{"operationId":"acceptRemoteOperatorPermissions","tags":["projects"],"summary":"Record that a Remote Operator installation's setup was re-applied","description":"Records the permissions compiled from the currently enabled operations as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorPermissions","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"reviewedPermissions":{"type":"array","items":{"$ref":"#/components/schemas/RemoteOperatorPermissionPlugin"},"description":"The enabled operations' permission declarations that the owner reviewed and re-applied."}},"required":["reviewedPermissions"]}}}},"responses":{"200":{"description":"The current permissions are recorded as installed.","content":{"application/json":{"schema":{"type":"object","properties":{"recordedAt":{"type":"string","format":"date-time"}},"required":["recordedAt"]}}}},"400":{"description":"The deployment is not a Kubernetes or ECS Remote Operator installation, or an enabled operation is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The enabled operations changed after the reviewed permissions were loaded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-metrics":{"get":{"operationId":"getProjectAiUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe AI Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"pricing":{"type":"object","properties":{"label":{"type":"string","enum":["Estimated provider cost"]},"coverage":{"type":"number","minimum":0,"maximum":1},"revision":{"type":"string","nullable":true}},"required":["label","coverage","revision"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","deploymentGroupId","name","externalId"]}},"models":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"publicModel":{"type":"string"},"provider":{"type":"string"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","publicModel","provider"]}},"customersTruncated":{"type":"boolean"},"modelsTruncated":{"type":"boolean"}},"required":["status","range","pricing","totals","timeSeries","customers","models","customersTruncated","modelsTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/encryption-metrics":{"get":{"operationId":"getProjectEncryptionUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getEncryptionUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Encryption Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","bucket"]}},"operations":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"operation":{"type":"string","enum":["encrypt","decrypt"]}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","operation"]}}},"required":["status","range","totals","timeSeries","operations"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/sandbox-metrics":{"get":{"operationId":"getProjectSandboxMetrics","x-speakeasy-group":"projects","x-speakeasy-name-override":"getSandboxMetrics","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Sandbox Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"externalId":{"type":"string","nullable":true},"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"lastSeenAt":{"type":"string","format":"date-time"}},"required":["deploymentGroupId","externalId","sessions","commands","lastSeenAt"]}},"customersTruncated":{"type":"boolean"}},"required":["status","range","totals","timeSeries","customers","customersTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups":{"post":{"operationId":"createDeploymentGroup","tags":["deployment-groups"],"summary":"Create a new deployment group","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group with this name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentGroups","tags":["deployment-groups"],"summary":"List deployment groups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of deployment groups","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"}}}]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-name":{"put":{"operationId":"ensureDeploymentGroupByName","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and name","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByNameRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-external-id":{"put":{"operationId":"ensureDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Optional for project-scoped API keys."},"required":false,"description":"Project ID or name. Optional for project-scoped API keys.","name":"project","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"required":true,"description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","name":"externalId","in":"query"}],"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project or deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/setup-links":{"post":{"operationId":"createSetupLink","tags":["setup-links"],"summary":"Create a customer setup link","description":"Ensures the Deployment Group identified by Project and external ID, then creates a group-scoped setup link with exact captured sources.","x-speakeasy-group":"setupLinks","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkRequest"}}}},"responses":{"200":{"description":"Customer environment ensured and setup link created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkResponse"}}}},"400":{"description":"Customer environment or setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Customer environment name or setup source conflicts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}":{"get":{"operationId":"getDeploymentGroup","tags":["deployment-groups"],"summary":"Get deployment group details","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"}],"responses":{"200":{"description":"Deployment group details","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"deploymentCount":{"type":"integer","description":"Current number of deployments in this deployment group"}},"required":["deploymentCount"]}]}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentGroup","tags":["deployment-groups"],"summary":"Update deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDeploymentGroup","tags":["deployment-groups"],"summary":"Delete deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Deployment group deleted successfully"},"400":{"description":"Cannot delete deployment group that has deployments","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/external-id":{"put":{"operationId":"setDeploymentGroupExternalId","tags":["deployment-groups"],"summary":"Set or clear a deployment group's external ID","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetDeploymentGroupExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group external ID updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group external ID already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/tokens":{"post":{"operationId":"createDeploymentGroupToken","tags":["deployment-groups"],"summary":"Create deployment group token","description":"Creates a deployment-group scoped API key and returns both the token and formatted deployment link","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenRequest"}}}},"responses":{"200":{"description":"Deployment group token created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"}}}},"400":{"description":"Deployment setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The project's sandbox configuration changed concurrently; retry the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/first-party-session":{"post":{"operationId":"createFirstPartyDeploymentSession","tags":["deployment-groups"],"summary":"Create first-party deployment session","description":"Mints a short-lived deployment-group token with the recommended self-deploy policy for the authenticated developer.","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"First-party deployment session created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateFirstPartyDeploymentSessionResponse"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external":{"get":{"operationId":"getExternalAIBinding","tags":["deployment-groups"],"summary":"Get external AI connection state","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"External AI connection state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBindingState"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putExternalAIBinding","tags":["deployment-groups"],"summary":"Connect or rotate an external AI provider key","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutExternalAIBindingRequest"}}}},"responses":{"202":{"description":"External AI connection stored and queued for checking","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBinding"}}}},"400":{"description":"The key is not valid for the selected provider","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The group already has an active cloud AI source","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Provider verification is temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteExternalAIBinding","tags":["deployment-groups"],"summary":"Revoke the external AI connection","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"External AI connection revoked"},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/models/{publicModelId}/checks":{"post":{"operationId":"createExternalAIModelCheck","tags":["deployment-groups"],"summary":"Queue an explicit external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":256},"required":true,"name":"publicModelId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"The potentially billable model check was queued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"400":{"description":"The model is not configured for this project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or binding not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/model-checks/{checkId}":{"get":{"operationId":"getExternalAIModelCheck","tags":["deployment-groups"],"summary":"Get an external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"checkId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Model check state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or check not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry":{"get":{"operationId":"getContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Container registry state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryState"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1,"maxLength":128}},"required":["deploymentId","resourceId"]}}}},"responses":{"200":{"description":"Registry route","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories":{"post":{"operationId":"createContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"}},"required":["name"]}}}},"responses":{"201":{"description":"Repository requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials":{"post":{"operationId":"createContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":64},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"minItems":1,"maxItems":100},"expiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["label","scope"]}}}},"responses":{"201":{"description":"Credential created; password is returned once","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateContainerRegistryCredentialResponse"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials/{credentialId}":{"delete":{"operationId":"revokeContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"required":true,"description":"Unique identifier for the container registry credential.","name":"credentialId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Credential revoked"},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories/{repositoryId}":{"delete":{"operationId":"deleteContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"required":true,"description":"Unique identifier for the container registry repository.","name":"repositoryId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"confirmName":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"disposition":{"type":"string","enum":["preserve","deleteContents"]}},"required":["confirmName","disposition"]}}}},"responses":{"202":{"description":"Repository deletion requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/verify":{"post":{"operationId":"verifyContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Verification requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/revoke":{"post":{"operationId":"revokeContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Registry revocation requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages":{"get":{"operationId":"listPackages","description":"List packages with optional filters. Returns packages ordered by creation date (newest first).","x-speakeasy-group":"packages","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Filter by package type"},"required":false,"description":"Filter by package type","name":"type","in":"query"},{"schema":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Filter by package status"},"required":false,"description":"Filter by package status","name":"status","in":"query"},{"schema":{"type":"string","pattern":"^rel_[0-9a-zA-Z]{28}$","description":"Filter by source release"},"required":false,"description":"Filter by source release","name":"sourceReleaseId","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search packages by type or version"},"required":false,"description":"Search packages by type or version","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of packages.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Package"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}":{"get":{"operationId":"getPackage","description":"Get details of a specific package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/rebuild":{"post":{"operationId":"rebuildPackages","description":"Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.","x-speakeasy-group":"packages","x-speakeasy-name-override":"rebuild","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to rebuild packages for"}},"required":["project"]}}}},"responses":{"200":{"description":"Packages rebuilt successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"packagesCreated":{"type":"integer","description":"Number of packages created"}},"required":["packagesCreated"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle the release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}/cancel":{"post":{"operationId":"cancelPackage","description":"Cancel a pending or building package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"cancel","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package canceled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"400":{"description":"Package cannot be canceled (not in pending or building status).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases":{"get":{"operationId":"listReleases","description":"Retrieve all releases.","x-speakeasy-group":"releases","x-speakeasy-name-override":"list","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","description":"Filter to releases promoted to this channel. Defaults to production."},"required":false,"description":"Filter to releases promoted to this channel. Defaults to production.","name":"channel","in":"query"},{"schema":{"type":"string","enum":["true","false"],"default":"false"},"required":false,"name":"allChannels","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search releases by commit message, branch, SHA, or release ID"},"required":false,"description":"Search releases by commit message, branch, SHA, or release ID","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by git branch (commitRef)"},"required":false,"description":"Filter by git branch (commitRef)","name":"branch","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by commit author login or name"},"required":false,"description":"Filter by commit author login or name","name":"author","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created after this date (ISO 8601)"},"required":false,"description":"Filter releases created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created before this date (ISO 8601)"},"required":false,"description":"Filter releases created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved releases.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createRelease","description":"Create a new release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateReleaseRequest"}}}},"responses":{"201":{"description":"Release created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Release"}}}},"400":{"description":"Invalid release request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/branches":{"get":{"operationId":"listReleaseBranches","description":"List distinct git branches across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listBranches","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search branches by name (case-insensitive contains)"},"required":false,"description":"Search branches by name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of branches to return"},"required":false,"description":"Maximum number of branches to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct branches.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/authors":{"get":{"operationId":"listReleaseAuthors","description":"List distinct commit authors across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listAuthors","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search authors by login or name (case-insensitive contains)"},"required":false,"description":"Search authors by login or name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of authors to return"},"required":false,"description":"Maximum number of authors to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct authors.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseAuthorFilterItem"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}":{"get":{"operationId":"getRelease","description":"Retrieve a release by ID.","x-speakeasy-group":"releases","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseListItemResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}/deployments":{"get":{"operationId":"listReleaseDeployments","description":"List the project's deployments with their rollout state relative to this release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseRolloutState"},"description":"Filter deployments by rollout state"},"required":false,"description":"Filter deployments by rollout state","name":"state","in":"query"},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved release deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseDeploymentsResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels":{"get":{"operationId":"listReleaseChannels","summary":"List release channels","description":"List the release channels configured for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Project release channels.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannel"}}},"required":["items"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createReleaseChannel","summary":"Create a release channel","description":"Create a release channel for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["name"],"additionalProperties":false}}}},"responses":{"201":{"description":"Channel created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"400":{"description":"Invalid release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}/promote":{"post":{"operationId":"promoteRelease","x-speakeasy-group":"releases","x-speakeasy-name-override":"promote","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"expectedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["releaseId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Release promoted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"404":{"description":"Project, channel, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel changed concurrently, or the sandbox bundle its release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}":{"delete":{"operationId":"deleteReleaseChannel","summary":"Delete a release channel","description":"Delete a release channel from a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"204":{"description":"Channel deleted."},"400":{"description":"Reserved channel.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel is still followed by deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments":{"get":{"operationId":"listDeployments","description":"Retrieve all deployments.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"list","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Filter by exact deployment name. Must be used with deploymentGroup."},"required":false,"description":"Filter by exact deployment name. Must be used with deploymentGroup.","name":"name","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name, public subdomain, or deployment group name"},"required":false,"description":"Search deployments by name, public subdomain, or deployment group name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved deployments.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid deployment list filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDeployment","description":"Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewDeploymentRequest"}}}},"responses":{"200":{"description":"Existing deployment returned for idempotent deployment-group registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"201":{"description":"Deployment created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"400":{"description":"Bad request - deployment group has reached max deployments limit.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden - insufficient permissions to create deployments in this context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment group not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/stats":{"get":{"operationId":"getDeploymentStats","description":"Get aggregated deployment statistics. Returns total count and breakdown by status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getStats","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name or deployment group name"},"required":false,"description":"Search deployments by name or deployment group name","name":"search","in":"query"}],"responses":{"200":{"description":"Deployment statistics retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentStats"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-environments":{"get":{"operationId":"listDeploymentFilterEnvironments","description":"List distinct effective environments used by deployments. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterEnvironments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Distinct environments retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-deployment-groups":{"get":{"operationId":"listDeploymentFilterDeploymentGroups","description":"List deployment groups with deployment counts. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterDeploymentGroups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return"},"required":false,"description":"Maximum number of items to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Deployment groups for filter retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"deploymentCount":{"type":"number"},"runningCount":{"type":"number","description":"Number of deployments in 'running' status"},"failedCount":{"type":"number","description":"Number of deployments in a failed status"},"inProgressCount":{"type":"number","description":"Number of deployments in an in-progress status (provisioning, updating, etc.)"}},"required":["id","name","deploymentCount","runningCount","failedCount","inProgressCount"]}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}":{"get":{"operationId":"getDeployment","description":"Retrieve a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentDetailResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/update-operations/{operationId}":{"get":{"operationId":"getDeploymentUpdateOperation","description":"Retrieve a deployment update operation by its durable operation ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getUpdateOperation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"required":true,"description":"Unique identifier for the deployment update operation.","name":"operationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment update operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}}}},"403":{"description":"The credential cannot read this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or update operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/info":{"get":{"operationId":"getDeploymentConnectionInfo","description":"Get deployment connection information including command endpoint and resource URLs.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment connection information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentConnectionInfo"}}}},"400":{"description":"Deployment not ready (no manager assigned).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/import":{"post":{"operationId":"importDeployment","description":"Import a deployment from resolved setup infrastructure such as CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"import","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportDeploymentRequest"}}}},"responses":{"200":{"description":"Deployment import was idempotent and returned an existing deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"201":{"description":"Deployment imported and created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/first-party-inputs":{"put":{"operationId":"setFirstPartyDeploymentInputs","description":"Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setFirstPartyDeploymentInputs","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Input values stored on the session token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsResponse"}}}},"400":{"description":"A deployment-group token scope is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The token is not a first-party deployment session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The requested release channel does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to store input values.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations":{"post":{"operationId":"createSetupRegistrationOperation","description":"Start a durable setup registration operation for CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createSetupRegistrationOperation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupRegistrationOperationRequest"}}}},"responses":{"202":{"description":"Setup registration operation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"400":{"description":"Invalid setup registration operation request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The credential cannot manage this setup registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed before callback acceptance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations/{id}":{"get":{"operationId":"getSetupRegistrationOperation","description":"Get setup registration operation status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getSetupRegistrationOperation","parameters":[{"schema":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"required":true,"description":"Unique identifier for the setup registration operation.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Setup registration operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"403":{"description":"The credential cannot read this setup registration result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Setup registration operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/delete":{"post":{"operationId":"deleteDeployment","description":"Delete, detach, or forget a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentRequest"}}}},"responses":{"202":{"description":"Deployment deletion request accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentResponse"}}}},"400":{"description":"Cannot delete the deployment in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/redeploy":{"post":{"operationId":"redeployDeployment","description":"Redeploy a running deployment with the same release and fresh environment variables. Sets status to update-pending.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"redeploy","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment redeployment triggered successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["message","operation"]}}}},"400":{"description":"Cannot redeploy - deployment must be running.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/pin-release":{"post":{"operationId":"pinDeploymentRelease","description":"Pin or unpin a running or runtime-failed deployment. Running deployments start an update; failed deployments retry toward the selected release.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"pinRelease","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PinReleaseRequest"}}}},"responses":{"202":{"description":"Release pin updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot pin release from the deployment's current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/release-channel":{"post":{"operationId":"setDeploymentReleaseChannel","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setReleaseChannel","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"channel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["channel"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployment release channel updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"400":{"description":"Channel release is unavailable for the deployment platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/retry":{"post":{"operationId":"retryDeployment","description":"Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"retry","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment retry enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Deployment is not in a failed state that can be retried.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment retry conflicts with current execution state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/inputs":{"get":{"operationId":"getDeploymentInputs","description":"Get the active input definitions and current non-secret values for a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment inputs returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInputsResponse"}}}},"403":{"description":"Insufficient permission to read deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentInputs","description":"Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Deployment inputs saved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsResponse"}}}},"400":{"description":"Input values are invalid for the deployment release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, project, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/compute":{"patch":{"operationId":"updateDeploymentCompute","description":"Update deployment-time compute pool selections and request reconciliation by the hosted manager.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateCompute","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentComputeRequest"}}}},"responses":{"200":{"description":"Compute settings saved or already current.","content":{"application/json":{"schema":{"type":"object","properties":{"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["outcome","operation"]}}}},"400":{"description":"Compute settings cannot be changed from the current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update compute settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/environment-variables":{"patch":{"operationId":"updateDeploymentEnvironmentVariables","description":"Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateEnvironmentVariables","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentEnvironmentVariablesRequest"}}}},"responses":{"202":{"description":"Environment variables updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Environment variables are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update environment variables.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/token":{"post":{"operationId":"createDeploymentToken","description":"Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenRequest"}}}},"responses":{"201":{"description":"Deployment token created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenResponse"}}}},"403":{"description":"Forbidden - insufficient permissions to issue a deployment token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}":{"put":{"operationId":"putDynamicContainer","description":"Create or replace a dynamic container in an existing deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"put","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string"},"required":false,"name":"if-match","in":"header"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutDynamicContainerRequest"}}}},"responses":{"202":{"description":"Desired state saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Generation conflict.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"501":{"description":"This deployment does not support dynamic containers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDynamicContainer","description":"Get one dynamic container's desired generation, status, and internal address.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic container.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDynamicContainer","description":"Remove a dynamic container from this deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"deleted":{"type":"boolean","enum":[true]}},"required":["name","deleted"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers":{"get":{"operationId":"listDynamicContainers","description":"List containers created after this deployment was installed.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic containers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}/logs":{"get":{"operationId":"getDynamicContainerLogs","description":"Read recent logs for one dynamic container.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"logs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":10080,"default":60},"required":false,"name":"sinceMinutes","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":200,"default":100},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"}],"responses":{"200":{"description":"Container logs.","content":{"application/json":{"schema":{"type":"object","properties":{"logs":{"type":"array","items":{"type":"object","properties":{"timestamp":{"type":"string","format":"date-time"},"level":{"type":"string"},"message":{"type":"string"},"replicaId":{"type":"string","nullable":true}},"required":["timestamp","level","message","replicaId"]}},"numHits":{"type":"number"},"nextCursor":{"type":"string","nullable":true},"partial":{"type":"boolean"},"errorCount":{"type":"number"}},"required":["logs","numHits","nextCursor","partial","errorCount"]}}}},"400":{"description":"Invalid cursor or time range.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Logs are unavailable for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/machines":{"get":{"operationId":"listDeploymentMachines","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listMachines","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines in every Horizon-backed ComputeCluster for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListDeploymentMachinesResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Horizon inventory could not be read.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation":{"get":{"operationId":"getDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current non-secret rotation state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationStatus"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"prepareDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"expectedRevision":{"type":"integer","minimum":0,"maximum":2147483644}},"required":["expectedRevision"],"additionalProperties":false}}}},"responses":{"200":{"description":"Prepared or replayed rotation; download values explicitly","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/cancel":{"post":{"operationId":"cancelDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Cancelled; apply the newer rollback values to restore the old credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/values":{"post":{"operationId":"getDeploymentCredentialRotationValues","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Secret values for this exact current rotation. Never persist in browser storage.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationValues"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/volume-restores":{"post":{"operationId":"createDeploymentVolumeRestore","description":"Replace one replica's persistent volume with a new volume made from a snapshot. The deployment must be running (an update may already be queued or in progress). The replica is stopped while its volume is swapped, and the replaced volume is snapshotted before it is deleted.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"restoreVolume","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateVolumeRestoreRequest"}}}},"responses":{"202":{"description":"Volume restore requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VolumeRestore"}}}},"400":{"description":"The deployment is not running, or the resource has no persistent volume for this replica.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A restore of this volume is already pending.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentVolumeRestores","description":"List a deployment's volume restore requests, newest first.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listVolumeRestores","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Volume restore requests.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListVolumeRestoresResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/volume-restores/{requestId}":{"delete":{"operationId":"cancelDeploymentVolumeRestore","description":"Cancel a pending volume restore. Use it when a restore keeps failing: the deployment stops attempting it. A restore whose volume was already swapped still finishes. Allowed in any deployment status, including update-failed.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"cancelVolumeRestore","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"vrst_[0-9a-z]{28}$","description":"Unique identifier for the volume restore.","example":"vrst_rs1j4dytswpy7wbc819jdcx"},"required":true,"description":"Unique identifier for the volume restore.","name":"requestId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Volume restore cancelled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VolumeRestore"}}}},"400":{"description":"The deployment has no deployed release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or volume restore not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The volume restore already completed or was cancelled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers":{"post":{"operationId":"createManager","description":"Create a new manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewManagerRequest"}}}},"responses":{"201":{"description":"Manager created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Invalid private manager setup method.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A manager for this target already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listManagers","description":"Retrieve all managers.","x-speakeasy-group":"managers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search managers by name"},"required":false,"description":"Search managers by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of managers to return"},"required":false,"description":"Maximum number of managers to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved managers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Manager"}}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/setup-token":{"post":{"operationId":"retryManagerSetup","description":"Revoke previous private-manager setup tokens and issue a fresh setup token/config.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retrySetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"201":{"description":"Fresh manager setup token generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Manager setup cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or setup config not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/retry":{"post":{"operationId":"retryManager","description":"Retry private-manager setup. Returns a fresh setup action before the internal deployment exists, or requests retry for the internal deployment after it exists.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retry","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager retry handled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerRetryResponse"}}}},"400":{"description":"Manager cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or internal deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/cancel-setup":{"post":{"operationId":"cancelManagerSetup","description":"Cancel pending private-manager setup, revoke setup/runtime tokens, and remove the undeployed manager record.","x-speakeasy-group":"managers","x-speakeasy-name-override":"cancelSetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager setup canceled successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Manager setup cannot be canceled in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}":{"get":{"operationId":"getManager","description":"Retrieve a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"get","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Manager"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteManager","description":"Delete a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager deletion enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot delete the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Internal deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/domain-binding":{"get":{"operationId":"getManagerDomainBinding","description":"Get the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager domain binding.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateManagerDomainBinding","description":"Create, update, or remove the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"updateDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerDomainBinding"}}}},"responses":{"200":{"description":"Manager domain binding updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"400":{"description":"Invalid domain binding request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or domain not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/management-config":{"get":{"operationId":"getManagerManagementConfig","description":"Get the management configuration for a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getManagementConfig","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":true,"description":"Represents the target cloud platform.","name":"platform","in":"query"}],"responses":{"200":{"description":"Management config retrieved successfully.","content":{"application/json":{"schema":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/provision":{"post":{"operationId":"provisionManager","description":"Enqueue provisioning for a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"provision","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager provisioning enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot provision the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/update":{"post":{"operationId":"updateManager","description":"Update a manager to a specific release ID or active release.","x-speakeasy-group":"managers","x-speakeasy-name-override":"update","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerRequest"}}}},"responses":{"202":{"description":"Manager update enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot update the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/events":{"get":{"operationId":"listManagerEvents","description":"Retrieve all events of a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"listEvents","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Event"}}},"required":["items"]}}}},"400":{"description":"Manager does not expose user-accessible events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/token":{"post":{"operationId":"generateManagerToken","description":"Generate a short-lived JWT for direct browser → manager communication. Used for fetching command payloads and querying logs without routing sensitive data through the platform API.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenRequest"}}}},"responses":{"200":{"description":"Manager access token and connection info.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/binding-token":{"post":{"operationId":"generateManagerBindingToken","description":"Generate a short-lived deployment-scoped token for resolving opted-in remote bindings through the currently assigned manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerBindingToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenRequest"}}}},"responses":{"200":{"description":"Remote Bindings token and assigned manager URL.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenResponse"}}}},"403":{"description":"The caller cannot access Remote Bindings for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Assigned manager or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A sandbox token was requested but the deployment's current release publishes no remote sandbox, or more than one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed, such as an unknown binding kind.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/gcp-oauth-provider/resolve":{"post":{"operationId":"resolveManagerGcpOAuthProvider","description":"Resolve decrypted project-level Google Cloud OAuth provider settings for a manager-side deployment bootstrap.","x-speakeasy-group":"managers","x-speakeasy-name-override":"resolveGcpOAuthProvider","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderRequest"}}}},"responses":{"200":{"description":"Resolved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderResponse"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Manager cannot resolve this deployment group's project settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/heartbeat":{"post":{"operationId":"reportManagerHeartbeat","description":"Report Manager health status and metrics.","x-speakeasy-group":"managers","x-speakeasy-name-override":"reportHeartbeat","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatRequest"}}}},"responses":{"200":{"description":"Heartbeat acknowledged.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/deployment":{"get":{"operationId":"getManagerDeployment","description":"Get deployment details for a private manager (internal deployment platform, status, resources).","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDeployment","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager deployment details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDeployment"}}}},"404":{"description":"Manager not found or has no internal deployment (alien-hosted managers don't have deployment info).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/snapshot":{"get":{"operationId":"getContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"responses":{"200":{"description":"Complete desired registry snapshot assigned to this Manager","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryManagerSnapshot"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/applied":{"post":{"operationId":"applyContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"routeId":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"desiredRevision":{"type":"integer","minimum":0},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"status":{"type":"string","enum":["ready","deleted","failed"]},"routableUpstreamName":{"type":"string","nullable":true,"minLength":1},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["id","status","routableUpstreamName","error"],"additionalProperties":false}},"verification":{"type":"object","nullable":true,"properties":{"succeeded":{"type":"boolean"},"observedAt":{"type":"string","format":"date-time"},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["succeeded","observedAt","error"],"additionalProperties":false}},"required":["routeId","desiredRevision","repositories","verification"],"additionalProperties":false}}}},"responses":{"200":{"description":"Applied registry snapshot revision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplyContainerRegistrySnapshotResponse"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/prepare":{"post":{"operationId":"prepareOperatorManifestPackage","tags":["operator-manifests"],"summary":"Prepare the white-labeled Operator image for an Operate install","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageRequest"}}}},"responses":{"200":{"description":"Operator image package created or reused.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/render":{"post":{"operationId":"renderOperatorManifest","tags":["operator-manifests"],"summary":"Render a Kubernetes Operator manifest","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestRequest"}}}},"responses":{"200":{"description":"Operator manifest rendered successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestResponse"}}}},"400":{"description":"An enabled custom plugin has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Operator image package is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid platform or manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/bootstrap-write-check":{"post":{"operationId":"checkEcsBootstrapWrite","tags":["operator-manifests"],"description":"Checks a Remote Operator setup token and its exact AWS target before the local bootstrap command writes a registration secret. A registered stack cannot use this path.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EcsBootstrapWriteCheckRequest"}}}},"responses":{"204":{"description":"The setup token may write the bootstrap secret."},"400":{"description":"The AWS target is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"The setup token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The setup token cannot read this deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The setup token does not match the target or the stack has registered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/render":{"post":{"operationId":"renderOperatorEcsCloudFormation","tags":["operator-manifests"],"summary":"Render a Remote Operator ECS Fargate CloudFormation installer","description":"Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from the project's enabled operations; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationRequest"}}}},"responses":{"200":{"description":"CloudFormation installer rendered, or null template and deployCommand while imagePending is true.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationResponse"}}}},"400":{"description":"Enabled AWS permissions cannot be safely compiled or directly deployed with the supplied resource ceilings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not authorized to update the project or use the selected Operator image package.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Operator image package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The selected Operator image package is unavailable, or the registered stack belongs to a different ECS cluster.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request body validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid Operator image or AWS manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys":{"get":{"operationId":"listAPIKeys","description":"Retrieve all API keys for the current workspace.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved API keys.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/APIKey"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAPIKey","description":"Create a new API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyRequest"}}}},"responses":{"201":{"description":"API key created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyResponse"}}}},"403":{"description":"Insufficient permissions to create API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/{id}":{"get":{"operationId":"getAPIKey","description":"Retrieve a specific API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateAPIKey","description":"Update an API key (enable/disable, change description).","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateAPIKeyRequest"}}}},"responses":{"200":{"description":"API key updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeAPIKey","description":"Revoke (soft delete) an API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"revoke","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"API key revoked successfully."},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/batch-delete":{"post":{"operationId":"deleteAPIKeys","description":"Permanently delete multiple API keys.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"deleteMultiple","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteAPIKeysRequest"}}}},"responses":{"200":{"description":"API keys deleted successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"deletedCount":{"type":"number"}},"required":["deletedCount"]}}}},"403":{"description":"Insufficient permissions to delete API keys.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains":{"get":{"operationId":"listDomains","description":"List system domains and workspace domains.","x-speakeasy-group":"domains","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domains.","content":{"application/json":{"schema":{"type":"object","properties":{"domains":{"type":"array","items":{"$ref":"#/components/schemas/DomainWithUsage"}}},"required":["domains"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDomain","description":"Create a workspace domain and optional initial endpoints.","x-speakeasy-group":"domains","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"setup":{"type":"object","properties":{"deploymentPortal":{"type":"boolean"},"packages":{"type":"boolean"},"deploymentUrlProjectId":{"type":"string","nullable":true,"pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"managerIds":{"type":"array","items":{"type":"string"}}}}},"required":["domain"]}}}},"responses":{"200":{"description":"Returned an existing workspace domain claim.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"201":{"description":"Created domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Domain is reserved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/endpoints":{"post":{"operationId":"createDomainEndpoint","description":"Create an endpoint under a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"createEndpoint","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"owner":{"type":"object","properties":{"type":{"type":"string","enum":["workspace","project","manager"]},"id":{"type":"string"}},"required":["type","id"]}},"required":["kind"]}}}},"responses":{"201":{"description":"Created endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Bad request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Endpoint cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}":{"get":{"operationId":"getDomain","description":"Get domain by ID.","x-speakeasy-group":"domains","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDomain","description":"Delete a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}},"required":["success"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain is in use.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/refresh":{"post":{"operationId":"refreshDomain","description":"Refresh workspace domain verification.","x-speakeasy-group":"domains","x-speakeasy-name-override":"refresh","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain verification refresh requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events":{"get":{"operationId":"listEvents","description":"Retrieve all events.","x-speakeasy-group":"events","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter events to a single deployment."},"required":false,"description":"Filter events to a single deployment.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Filter events to a single release."},"required":false,"description":"Filter events to a single release.","name":"releaseId","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["releaseCreatedAt"]},"description":"Optional fields to include: releaseCreatedAt"},"required":false,"description":"Optional fields to include: releaseCreatedAt","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/EventListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events/{id}":{"get":{"operationId":"getEvent","description":"Retrieve an event by ID.","x-speakeasy-group":"events","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"required":true,"description":"Unique identifier for the event.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved event.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Event"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents":{"get":{"operationId":"listIncidents","description":"List authorized incidents without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string"},"required":false,"name":"projectId","in":"query"},{"schema":{"type":"string","enum":["queued","running","halted","complete","error","canceled"]},"required":false,"name":"status","in":"query"},{"schema":{"type":"string","maxLength":256},"required":false,"name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":25},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incidents.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentListResponse"}}}},"400":{"description":"Invalid request or cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents/{id}":{"get":{"operationId":"getIncident","description":"Get an authorized incident without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incident.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Incident not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens":{"get":{"operationId":"listMachinesJoinTokens","x-speakeasy-group":"machines","x-speakeasy-name-override":"listJoinTokens","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Join tokens for a Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMachinesJoinTokensResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"createJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Newly minted Machines join token. Existing tokens keep working; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/rotate":{"post":{"operationId":"rotateMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"rotateJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Rotated Machines join token. Revokes all existing tokens, then mints a new one; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/{tokenId}":{"delete":{"operationId":"revokeMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"revokeJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"tokenId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines join token revocation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}/drain":{"delete":{"operationId":"cancelMachinesMachineDrain","x-speakeasy-group":"machines","x-speakeasy-name-override":"cancelMachineDrain","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines drain cancellation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelMachinesMachineDrainResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"drainMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"drainMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineRequest"}}}},"responses":{"200":{"description":"Machines drain request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}":{"delete":{"operationId":"removeMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"removeMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines remove request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoveMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/bootstrap":{"post":{"operationId":"bootstrapCommands","description":"Resolve a deployment's current manager and mint a five-minute command capability. Sender tokens can dispatch and observe commands only for this deployment. Receiver tokens can lease and complete commands only for the resolved Container or Daemon target.","x-speakeasy-group":"commands","x-speakeasy-name-override":"bootstrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapRequest"}}}},"responses":{"200":{"description":"Manager connection details and a short-lived command capability.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapResponse"}}}},"400":{"description":"Invalid request or deployment state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot operate this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, manager, or receiver target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The selected resource cannot run an external receiver.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands":{"get":{"operationId":"listCommands","description":"Retrieve commands. Use for dashboard analytics and command history.","x-speakeasy-group":"commands","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Filter by command state"},"required":false,"description":"Filter by command state","name":"state","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Filter by command name"},"required":false,"description":"Filter by command name","name":"name","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search commands by name"},"required":false,"description":"Search commands by name","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created after this date (ISO 8601)"},"required":false,"description":"Filter commands created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created before this date (ISO 8601)"},"required":false,"description":"Filter commands created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deployment","project"]},"description":"Optional fields to include: deployment, project"},"required":false,"description":"Optional fields to include: deployment, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved commands.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/CommandListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createCommand","description":"Create command metadata. Called by manager when processing commands. Returns project info for routing decisions.","x-speakeasy-group":"commands","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandRequest"}}}},"responses":{"201":{"description":"Command created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandResponse"}}}},"400":{"description":"Deployment is not ready or has no assigned manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The operation access request is no longer approved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The deployment manager is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/names":{"get":{"operationId":"listCommandNames","description":"List distinct command names. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listNames","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search command names (prefix match)"},"required":false,"description":"Search command names (prefix match)","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct command names.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandNamesResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/deployments":{"get":{"operationId":"listCommandDeployments","description":"List distinct deployments that have commands, including deployment group info. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search deployment or deployment group names"},"required":false,"description":"Search deployment or deployment group names","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct deployments that have commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandDeploymentsResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/target":{"get":{"operationId":"resolveCommandTarget","description":"Resolve which resource a command for this deployment would be addressed to, and how it would be delivered. Fails when the deployment has no command-capable resources, or more than one and no explicit target was named.","x-speakeasy-group":"commands","x-speakeasy-name-override":"resolveTarget","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment to resolve the target for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Deployment to resolve the target for","name":"deploymentId","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Explicit resource id to resolve; must be a command-capable resource"},"required":false,"description":"Explicit resource id to resolve; must be a command-capable resource","name":"target","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":255,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead."},"required":false,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead.","name":"command","in":"query"}],"responses":{"200":{"description":"Resolved command target.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolvedCommandTarget"}}}},"404":{"description":"Deployment or target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}":{"patch":{"operationId":"updateCommand","description":"Update command state. Called by manager when command is dispatched or completes.","x-speakeasy-group":"commands","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateCommandRequest"}}}},"responses":{"200":{"description":"Command updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getCommand","description":"Retrieve a command by ID.","x-speakeasy-group":"commands","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["true"],"description":"Explicitly confirm access to an operation result marked sensitive."},"required":false,"description":"Explicitly confirm access to an operation result marked sensitive.","name":"confirmSensitiveOutput","in":"query"}],"responses":{"200":{"description":"Retrieved command.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid operation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/dispatch":{"post":{"operationId":"dispatchCommand","description":"Atomically mark a command DISPATCHED unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"dispatch","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandRequest"}}}},"responses":{"200":{"description":"Dispatch attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/complete":{"post":{"operationId":"completeCommand","description":"Atomically transition a command to a terminal state (SUCCEEDED, FAILED, or EXPIRED) unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"complete","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandRequest"}}}},"responses":{"200":{"description":"Completion attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/increment-attempt":{"post":{"operationId":"incrementCommandAttempt","description":"Atomically increment the command's attempt counter and return the new value.","x-speakeasy-group":"commands","x-speakeasy-name-override":"incrementAttempt","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Attempt incremented.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncrementCommandAttemptResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions":{"get":{"operationId":"listDebugSessions","description":"Retrieve debug sessions for dashboard audit. Filters: project, deployment, state, mode.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Filter by session state"}]},"required":false,"description":"Filter by session state","name":"state","in":"query"},{"schema":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model (push/pull). Joins against the parent deployment."},"required":false,"description":"Filter by deployment model (push/pull). Joins against the parent deployment.","name":"mode","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Filter by cloud provider. Joins against the parent deployment."},"required":false,"description":"Filter by cloud provider. Joins against the parent deployment.","name":"provider","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Paginated debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSessionListResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDebugSession","description":"Create a debug-session audit row. Called by the manager when a pull or push debug tunnel is opened. Workspace + project derived from deployment.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDebugSessionRequest"}}}},"responses":{"201":{"description":"Debug session created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Deployment or access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions/{id}":{"patch":{"operationId":"updateDebugSession","description":"Update debug-session state. Called by manager on tunnel attach, close, or deadline expiry.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDebugSessionRequest"}}}},"responses":{"200":{"description":"Debug session updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Debug session not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDebugSession","description":"Retrieve a debug session by ID.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved debug session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info":{"get":{"operationId":"getDeploymentInfo","description":"Get deployment information for the deployment portal. Accepts both deployment-scoped and deployment-group-scoped API keys. Returns project information, package status/outputs, and either deployment or deployment group details depending on the token type. Poll this endpoint to check if packages are ready.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":false,"description":"Represents the target cloud platform.","name":"platform","in":"query"},{"schema":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":false,"name":"setupItem","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"updateOperationId","in":"query"}],"responses":{"200":{"description":"Deployment information retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInfo"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-scoped or deployment-group-scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/compute-plan":{"post":{"operationId":"planDeploymentCompute","description":"Plan deployment compute for the active release before stack preparation. The response contains recommended machine and scale choices for cloud compute pools.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"planCompute","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Compute plan returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentComputePlan"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/prepare-stack":{"post":{"operationId":"prepareDeploymentStack","description":"Prepare the active release stack for a deployment portal setup session. The response contains the generated stack shape plus setup compatibility metadata.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"prepareStack","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"saveForSetup":{"type":"boolean","description":"Persist validated choices for the exact blocked update; does not apply cloud changes."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Prepared stack returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PreparedDeploymentStack"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/install-url":{"post":{"operationId":"slackIntegrationInstallUrl","description":"Generate the Slack OAuth consent URL for this workspace.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"installUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"OAuth URL the dashboard should redirect the user to.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackInstallUrlResponse"}}}},"500":{"description":"Server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/status":{"get":{"operationId":"slackIntegrationStatus","description":"Return the Slack install for this workspace (if any).","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"status","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackIntegrationStatus"}}}}}}},"/v1/integrations/slack/channels":{"get":{"operationId":"slackIntegrationChannels","description":"List public Slack channels for this workspace's install. Used by the dashboard's notification-channel picker.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"listChannels","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Public channels.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackChannelsResponse"}}}},"400":{"description":"Workspace not connected to Slack.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/notification-channel":{"put":{"operationId":"slackIntegrationSetNotificationChannel","description":"Configure which Slack channel receives ai-agent monitor reports.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"setNotificationChannel","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelRequest"}}}},"responses":{"200":{"description":"Channel saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelResponse"}}}},"400":{"description":"Not connected, or join failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/installation":{"delete":{"operationId":"slackIntegrationUninstall","description":"Uninstall the Slack integration for this workspace. Revokes the bot token at Slack and deletes the row.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"uninstall","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Uninstalled."}}}},"/v1/agent-sessions":{"get":{"operationId":"listAgentSessions","description":"List ai-agent monitor sessions for this workspace, or for one project. Newest first, capped at 50.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},{"description":"Only sessions bound to this project. Omit to list the whole workspace."}]},"required":false,"description":"Only sessions bound to this project. Omit to list the whole workspace.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionListResponse"}}}}}}},"/v1/agent-sessions/{id}":{"get":{"operationId":"getAgentSession","description":"Retrieve one ai-agent monitor session by id.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionDetail"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/events":{"get":{"operationId":"listAgentSessionEvents","description":"Incrementally read a session's event log (steps, tool calls, report deltas, approvals, status transitions). Pass the previous response's `latestSeq` as `after` to fetch only new events.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"events","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","nullable":true,"minimum":0,"default":0},"required":false,"name":"after","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":500,"default":200},"required":false,"name":"limit","in":"query"}],"responses":{"200":{"description":"Events after the cursor, oldest first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionEventsResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/stop":{"post":{"operationId":"stopAgentSession","description":"Stop (cancel) a running or queued ai-agent monitor session. Proxies to the ai-agent service, minting a fresh CLI session for the caller so the ai-agent's own auth applies. Idempotent — stopping an already-terminal session is a 200 no-op.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"stop","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Already terminal / no-op.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"202":{"description":"Cancel accepted; session stopped.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"AI agent service is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins":{"get":{"operationId":"listOperationsPlugins","description":"List available operations plugins (builtin + custom) for a project, with their operations and risk tiers.","x-speakeasy-group":"operations","x-speakeasy-name-override":"listPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The operations plugin catalog.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListOperationsPluginsResponse"}}}},"409":{"description":"A persisted custom plugin has invalid metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"publishOperationsPlugin","description":"Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"publishPlugin","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginRequest"}}}},"responses":{"201":{"description":"The plugin was published, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginResponse"}}}},"400":{"description":"Invalid metadata, or no bundle was uploaded for this name/version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A plugin with this name is already published at this version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/builtin/enabled":{"put":{"operationId":"setBuiltinOperationsPlugins","description":"Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setBuiltinPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsRequest"}}}},"responses":{"200":{"description":"The enabled built-in plugin set was replaced, with the cloud permission delta.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsResponse"}}}},"400":{"description":"One or more plugin names are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/upload-url":{"post":{"operationId":"createOperationsBundleUploadUrl","description":"Get a presigned S3 URL to upload a custom operations plugin bundle ZIP. Upload the ZIP with a PUT to the returned url (sending the given Content-Type), then call POST /plugins to register it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"createBundleUploadUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlRequest"}}}},"responses":{"200":{"description":"A presigned upload URL for the bundle ZIP.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlResponse"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Bundle storage is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/{name}/enabled":{"patch":{"operationId":"setOperationsPluginEnabled","description":"Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setPluginEnabled","parameters":[{"schema":{"type":"string","description":"Plugin name."},"required":true,"description":"Plugin name.","name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledRequest"}}}},"responses":{"200":{"description":"The plugin's enabled state was updated, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledResponse"}}}},"404":{"description":"No such plugin for this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The plugin metadata is invalid for the requested enabled state, or the permission delta differs from `expectedPermissionDiff`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/policy":{"get":{"operationId":"getOperationsPolicy","description":"Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"getPolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The approval policy rules and default.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateOperationsPolicy","description":"Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"updatePolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateOperationsPolicyRequest"}}}},"responses":{"200":{"description":"The updated approval policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/invoke":{"post":{"operationId":"invokeOperation","description":"Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"invoke","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationRequest"}}}},"responses":{"200":{"description":"The operation was dispatched or queued for approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationResponse"}}}},"400":{"description":"Parameters do not satisfy the operation's published input schema.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not create commands for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Plugin or operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Plugin is disabled or has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/verify-check":{"post":{"operationId":"verifyOperationCheck","description":"One verification poll cycle for an original operation command. Loads that command's authoritative stored result and dispatch-time verification contract, dispatches the frozen read-only poll operation once, and evaluates its frozen success condition. Callers poll this repeatedly per the returned policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"verifyCheck","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckRequest"}}}},"responses":{"200":{"description":"The outcome of this single verification poll cycle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckResponse"}}}},"400":{"description":"The verification command cannot be dispatched to the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not dispatch verification commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or original command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid verification command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests":{"post":{"operationId":"createAccessRequest","description":"Create an access request — either plan-backed (an ai-agent investigation's exact commands) or plan-less (a CLI-originated exact operation or wildcard pattern, resolved and frozen here). Plan-backed requests await the engineer gate (status `pending-approval`); plan-less requests are queued immediately since the requester is asking for their own access (status `queued`).","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAccessRequest"}}}},"responses":{"201":{"description":"The created access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"400":{"description":"Invalid create payload or requested expiry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The requester cannot access the target deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or remediation plan not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Replay key payload conflicts or the remediation plan already has a request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listAccessRequests","description":"List a project's access requests, newest first.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AccessRequestStatus"},"description":"Filter by status."},"required":false,"description":"Filter by status.","name":"status","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Only requests proposed by this investigation's remediation plan."},"required":false,"description":"Only requests proposed by this investigation's remediation plan.","name":"agentSessionId","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"The project's access requests.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/queue":{"post":{"operationId":"queueAccessRequest","description":"Engineer gate — approve a pending access request, queuing it for the operator to materialize. Records who queued it.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The queued access request, with the customer approve command.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"kubectlApprove":{"type":"string","nullable":true}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","kubectlApprove"]}}}},"400":{"description":"The requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not pending approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/approve":{"post":{"operationId":"approveAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may approve a queued access request. Actor identity comes from authentication; method/source are audit context only.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}},"approvedForMinutes":{"type":"integer","minimum":0,"exclusiveMinimum":true}},"required":["method"]}}}},"responses":{"200":{"description":"The approved access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"approvalMethod":{"$ref":"#/components/schemas/AccessRequestApprovalMethod"}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","approvalMethod"]}}}},"400":{"description":"The approval window or requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued, or its requester identity is unknown and a new request is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/deny":{"post":{"operationId":"denyAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may reject a queued access request. Actor identity comes from authentication.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}}},"required":["method"]}}}},"responses":{"200":{"description":"The rejected access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued (already approved, denied, expired, or still pending the engineer gate).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/coordinates":{"get":{"operationId":"getAccessRequestCoordinates","description":"The customer's kubectl approve command for a queued access request, or null until the operator has materialized the grant CR and reported its coordinates. Polled by the Slack handler to update the access-plan card.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The approve command (or null) and current status.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"kubectlApprove":{"type":"string","nullable":true}},"required":["status","kubectlApprove"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/pending":{"get":{"operationId":"listPendingAccessRequests","description":"Operator-facing: queued access requests whose requester deadline has not elapsed, for the access-request sync loop to materialize as grant CRs.","x-speakeasy-ignore":true,"parameters":[{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Queued access requests for the deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"requests":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"requestedExpiresAt":{"type":"string","nullable":true}},"required":["id","title","reason","commands","debugGrant","requestedExpiresAt"]}},"revokedRequestIds":{"type":"array","items":{"type":"string"},"description":"Requests revoked in the last six hours, or revoked while their approved window is still open, so the operator can mark their grant CRs REVOKED. Older operators ignore this field."}},"required":["requests","revokedRequestIds"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/materialized":{"post":{"operationId":"reportMaterializedAccessRequests","description":"Operator-facing: record the namespace + CRD plural the operator materialized the grant CRs in, so the control plane can render the customer's exact kubectl approve command.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"requestIds":{"type":"array","items":{"type":"string"}},"namespace":{"type":"string","minLength":1},"resourcePlural":{"type":"string","minLength":1}},"required":["deploymentId","requestIds","namespace","resourcePlural"]}}}},"responses":{"200":{"description":"Number of requests updated with CR coordinates.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/approvals":{"post":{"operationId":"reportAccessApprovals","description":"Operator-facing: record the customer's approval windows reported back by the sync loop. Retires requester-expired requests and skips stale windows without blocking live approvals. Moves live requests to customer-approved and resumes the investigation to dispatch commands.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"approvals":{"type":"array","items":{"type":"object","properties":{"requestId":{"type":"string"},"approvedUntil":{"type":"string"}},"required":["requestId","approvedUntil"]}}},"required":["deploymentId","approvals"]}}}},"responses":{"200":{"description":"Number of approvals recorded.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"400":{"description":"Invalid approval report payload.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/live-debug-grant":{"get":{"operationId":"getLiveDebugGrant","description":"Find an approved, unexpired access request the caller created whose debug grant matches this deployment and tool (and, when given, namespace/cloudScope). Returns the most recently approved match, or 404 when none is live. Used to reuse an existing grant instead of proposing a new access request. Only the requester's own grants match: a debug session must present a grant its caller requested, so another principal's grant is never returned here.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"The deployment to check for a live debug grant.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"The deployment to check for a live debug grant.","name":"deploymentId","in":"query"},{"schema":{"$ref":"#/components/schemas/DebugGrantTool"},"required":true,"name":"debugTool","in":"query"},{"schema":{"type":"string","description":"Match a `kubectl` grant scoped to this namespace exactly."},"required":false,"description":"Match a `kubectl` grant scoped to this namespace exactly.","name":"debugNamespace","in":"query"},{"schema":{"type":"string","description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly."},"required":false,"description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly.","name":"debugCloudScope","in":"query"}],"responses":{"200":{"description":"A live access request with a matching debug grant.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"No approved, unexpired access request matches.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/activity":{"get":{"operationId":"getAccessRequestActivity","description":"The operation commands and debug sessions an access request authorized, with each command's verification outcome. Authorized like getAccessRequest.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The request's operations and debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRequestActivity"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/revoke":{"post":{"operationId":"revokeAccessRequest","description":"Revoke a pending, queued or customer-approved access request. The principal that created the request, or any workspace member or administrator who can read its project, may revoke it. Commands the grant authorized that have not been dispatched are failed; dispatched commands finish. Linked debug sessions are stopped and refuse their next request. Revoking an already revoked request returns it unchanged.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeAccessRequest"}}}},"responses":{"200":{"description":"The revoked access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"The caller may read but not revoke this request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The request has already expired or been rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}":{"get":{"operationId":"getAccessRequest","description":"Get an access request by id.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/list":{"post":{"operationId":"syncList","description":"List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.","x-speakeasy-group":"sync","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListRequest"}}}},"responses":{"200":{"description":"Full deployment records returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/context":{"post":{"operationId":"syncContext","description":"Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.","x-speakeasy-group":"sync","x-speakeasy-name-override":"context","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncContextRequest"}}}},"responses":{"200":{"description":"Computed deployment context returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"}}}},"404":{"description":"Deployment not found or not assigned to this manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to build deployment context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/acquire":{"post":{"operationId":"syncAcquire","description":"Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.","x-speakeasy-group":"sync","x-speakeasy-name-override":"acquire","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireRequest"}}}},"responses":{"200":{"description":"Deployments acquired successfully (empty arrays if none available). Failures indicate deployments that were locked but failed during context building - their locks have been released.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/reconcile":{"post":{"operationId":"syncReconcile","description":"Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.","x-speakeasy-group":"sync","x-speakeasy-name-override":"reconcile","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileRequest"}}}},"responses":{"200":{"description":"State reconciled successfully. If target is present, continue deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment locked (pull) or session mismatch (push).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/renew":{"post":{"operationId":"syncRenew","x-speakeasy-group":"sync","x-speakeasy-name-override":"renew","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncRenewRequest"}}}},"responses":{"200":{"description":"Renewal processed. Inspect `leases` for per-deployment outcomes; a lost lease is reported there rather than failing the whole batch.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when every requested deployment was renewed."},"leases":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"renewed":{"type":"boolean","description":"False when this session no longer holds a live lease."},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["deploymentId","renewed","leaseExpiresAt"]},"description":"Per-deployment renewal outcome."}},"required":["success","leases"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The session no longer owns the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/release":{"post":{"operationId":"syncRelease","description":"Release a deployment lock. Must be called after processing an acquired deployment, even if processing failed. This is critical to avoid deadlocks.","x-speakeasy-group":"sync","x-speakeasy-name-override":"release","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReleaseRequest"}}}},"responses":{"200":{"description":"Lock released successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when released or the exact terminal receipt was acknowledged. False when completion could not be established."}},"required":["success"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources":{"get":{"operationId":"listInventory","x-speakeasy-group":"resources","x-speakeasy-name-override":"listInventory","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Unified managed and observed resource inventory rows.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"},"source":{"type":"string","enum":["managed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt","source","deploymentId","deploymentName"]},{"type":"object","properties":{"source":{"type":"string","enum":["observed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"rawKind":{"type":"string"},"alienResourceId":{"type":"string","nullable":true},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["source","deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","name","rawKind","alienResourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}":{"get":{"operationId":"listResourceOverview","x-speakeasy-group":"resources","x-speakeasy-name-override":"listOverview","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Compute resource overview rows from latest heartbeats.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/{resourceId}/deployments":{"get":{"operationId":"listResourceDeployments","description":"List deployments where the selected resource is installed.","x-speakeasy-group":"resources","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Deployments where the resource is installed.","content":{"application/json":{"schema":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"deployments":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt"]}}},"required":["resourceType","resourceId","deployments"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/deployments/{deploymentId}/{resourceId}":{"get":{"operationId":"getResourceDeploymentDetail","x-speakeasy-group":"resources","x-speakeasy-name-override":"getDeploymentDetail","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Latest heartbeat detail for one resource deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"deployment":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"},"desiredImage":{"type":"string","nullable":true}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt","desiredImage"]},"heartbeat":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"staleAt":{"type":"string","format":"date-time"},"platformStale":{"type":"boolean"},"heartbeat":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"raw":{"type":"array","items":{"nullable":true}}},"required":["status","deploymentId","resourceId","resourceType","backend","controllerPlatform","observedAt","staleAt","platformStale","heartbeat","raw"]},{"type":"object","properties":{"status":{"type":"string","enum":["missing"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"}},"required":["status","deploymentId","resourceId","resourceType"]}]}},"required":["deployment","heartbeat"]}}}},"404":{"description":"Deployment or resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys":{"get":{"operationId":"listAwsVirtualKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"AWS Virtual Keys in a project","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKeys":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}},"required":["virtualKeys"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAwsVirtualKey","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"selector":{"oneOf":[{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false}]},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128},"alias":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"description":{"type":"string","nullable":true,"maxLength":8192},"deletionWindowDays":{"type":"integer","minimum":7,"maximum":30,"default":30},"tags":{"type":"object","additionalProperties":{"type":"string","maxLength":256},"default":{}}},"required":["selector","awsAccountId","awsRegion","idempotencyKey"]}}}},"responses":{"200":{"description":"Created or resumed Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Enterprise Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Gateway unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/rotate-credential":{"post":{"operationId":"rotateAwsVirtualKeyCredential","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"generation":{"type":"integer","minimum":2}},"required":["generation"]}}}},"responses":{"200":{"description":"The resumable XKS proxy credential rotation bundle","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot begin rotation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/restore":{"post":{"operationId":"restoreAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key awaiting a successful AWS XKS canary after restore","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot be restored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/finalize-deletion":{"post":{"operationId":"finalizeAwsVirtualKeyDeletion","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key whose final AWS KMS deletion was observed","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key deletion cannot be finalized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/decommission":{"post":{"operationId":"decommissionAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"},"deletionScheduledAt":{"type":"string","format":"date-time"}},"required":["kmsKeyArn","deletionScheduledAt"]}}}},"responses":{"200":{"description":"Virtual Key with AWS deletion scheduled","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"AWS key does not match","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}":{"get":{"operationId":"getAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"responses":{"200":{"description":"AWS Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/continue":{"post":{"operationId":"continueAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"customKeyStoreId":{"type":"string","pattern":"^cks-[A-Za-z0-9]+$"},"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["customKeyStoreId","kmsKeyArn"]}}}},"responses":{"200":{"description":"Updated AWS setup facts","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Setup facts conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resolve":{"get":{"operationId":"resolve","tags":["resolve"],"summary":"Resolve manager for a project and platform","description":"Returns the manager URL for a given project and platform. The project can be provided as a query parameter, or derived from the token's scope (project-scoped, deployment-group-scoped, or deployment-scoped tokens carry an implicit project). This is the single entry point for all CLI tools to discover which manager to talk to.","x-speakeasy-group":"resolve","x-speakeasy-name-override":"resolve","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform to resolve the manager for"},"required":true,"description":"Target platform to resolve the manager for","name":"platform","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope)."},"required":false,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope).","name":"project","in":"query"}],"responses":{"200":{"description":"Manager resolved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveResponse"}}}},"400":{"description":"Missing required project parameter for this token type.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found or no manager available for platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Manager not ready yet (no URL reported). Retry after a delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/cloud-regions":{"get":{"operationId":"getCloudRegions","description":"Get cloud regions supported by this Alien environment.","x-speakeasy-group":"cloudRegions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Supported cloud regions retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudRegionsResponse"}}}}}}},"/v1/billing/audit-log":{"get":{"operationId":"listBillingAuditLog","description":"List billing activity entries for the current workspace.","x-speakeasy-group":"billing","x-speakeasy-name-override":"listAuditLog","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"number","minimum":1,"maximum":200,"default":50},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor: id from the previous page."},"required":false,"description":"Cursor: id from the previous page.","name":"before","in":"query"}],"responses":{"200":{"description":"Audit-log rows newest-first.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/BillingAuditLogRow"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"]}}}}}}},"/v1/billing/entitlements":{"get":{"operationId":"getWorkspaceBillingEntitlements","description":"Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.","x-speakeasy-group":"billing","x-speakeasy-name-override":"getEntitlements","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace billing entitlements.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceBillingEntitlements"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/gateways/{gateway}/overview":{"get":{"operationId":"getWorkspaceGatewayOverview","description":"Get compact cross-Project setup and customer status for a workspace Gateway.","x-speakeasy-group":"gateways","x-speakeasy-name-override":"getWorkspaceOverview","parameters":[{"schema":{"$ref":"#/components/schemas/GatewayKind"},"required":true,"description":"Alien Gateway a customer deployment runs","name":"gateway","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace Gateway overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceGatewayOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}}}}
diff --git a/client-sdks/platform/rust/build/openapi_filter.rs b/client-sdks/platform/rust/build/openapi_filter.rs
index f84f3bd741..2696e93814 100644
--- a/client-sdks/platform/rust/build/openapi_filter.rs
+++ b/client-sdks/platform/rust/build/openapi_filter.rs
@@ -34,6 +34,7 @@ const OPEN_STRING_ENUM_SCHEMAS: &[(&str, &str)] = &[
 /// Keep this list explicit: adding a Platform API call should require a review
 /// of the compiler input it brings into the always-enabled CLI graph.
 pub const REQUIRED_OPERATION_IDS: &[&str] = &[
+    "cancelDeploymentVolumeRestore",
     "configureProjectBuckets",
     "configureProjectDeployments",
     "configureProjectKeys",
@@ -46,6 +47,7 @@ pub const REQUIRED_OPERATION_IDS: &[&str] = &[
     "createDeploymentGroup",
     "createDeploymentGroupToken",
     "createDeploymentToken",
+    "createDeploymentVolumeRestore",
     "createProject",
     "createRelease",
     "createReleaseChannel",
@@ -81,6 +83,7 @@ pub const REQUIRED_OPERATION_IDS: &[&str] = &[
     "listDeployments",
     "listEvents",
     "listDeploymentMachines",
+    "listDeploymentVolumeRestores",
     "listManagerEvents",
     "listManagers",
     "listMemberships",
diff --git a/client-sdks/platform/rust/openapi-3.0.json b/client-sdks/platform/rust/openapi-3.0.json
index f1af52ac69..7b077c7a53 100644
--- a/client-sdks/platform/rust/openapi-3.0.json
+++ b/client-sdks/platform/rust/openapi-3.0.json
@@ -1 +1 @@
-{"openapi":"3.0.0","info":{"title":"Alien API","version":"1.0.0","contact":{"name":"Alien Team","url":"https://alien.dev"}},"servers":[{"url":"https://api.alien.dev","description":"Alien API - Production"}],"security":[{"apiKey":[]}],"components":{"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","bearerFormat":"API key","description":"API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys"}},"schemas":{"WorkspaceInvitationPreview":{"type":"object","properties":{"kind":{"type":"string","enum":["email","link"]},"workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name","logoUrl"]},"inviter":{"type":"object","nullable":true,"properties":{"name":{"type":"string"},"image":{"type":"string","nullable":true,"format":"uri"}},"required":["name","image"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"state":{"type":"string","enum":["active","accepted","expired","revoked"]},"emailHint":{"type":"string","nullable":true}},"required":["kind","workspace","inviter","role","expiresAt","state","emailHint"],"additionalProperties":false},"WorkspaceRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"Role for workspace-scoped service accounts","example":"workspace.member"},"APIError":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"requestId":{"type":"string","description":"Request ID echoed in the x-request-id response header and server logs."}},"required":["code","message","internal"]},"Membership":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"role":{"type":"string"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","logoUrl","role","createdAt"],"additionalProperties":false},"UserProfile":{"type":"object","properties":{"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","description":"User's email address"},"name":{"type":"string","description":"User's display name"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"},"githubUsername":{"type":"string","nullable":true,"description":"Linked GitHub username"},"cliConnected":{"type":"boolean","description":"Whether this user has ever authenticated a request from the Alien CLI. Latched on first CLI request, never cleared."},"company":{"type":"string","nullable":true,"description":"Company name collected during profile setup."},"acquisitionSource":{"type":"string","nullable":true,"enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other",null],"description":"How the user heard about Alien."},"acquisitionSourceDetail":{"type":"string","nullable":true,"description":"Additional acquisition source detail when the source is other."},"useCases":{"type":"string","nullable":true,"description":"What the user is hoping to use Alien for."},"profileSetupCompletedAt":{"type":"string","format":"date-time","nullable":true,"description":"When the user completed the required profile setup dialog."},"profileSetupVersion":{"type":"integer","nullable":true,"description":"Version of the required profile setup dialog the user completed."}},"required":["id","email","name","image","githubUsername","cliConnected","company","acquisitionSource","acquisitionSourceDetail","useCases","profileSetupCompletedAt","profileSetupVersion"],"additionalProperties":false},"UserProfileSetupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"},"company":{"type":"string","minLength":1,"maxLength":120,"description":"Company name"},"acquisitionSource":{"type":"string","enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other"],"description":"How the user heard about Alien"},"acquisitionSourceDetail":{"type":"string","minLength":1,"maxLength":200,"description":"Required when acquisitionSource is other"},"useCases":{"type":"string","maxLength":2000,"description":"What the user is hoping to use Alien for"}},"required":["name","company","acquisitionSource"],"additionalProperties":false},"GitNamespace":{"type":"object","properties":{"id":{"type":"number","nullable":true},"name":{"type":"string"},"slug":{"type":"string"},"installationId":{"type":"number","nullable":true},"type":{"type":"string","enum":["team","user"]},"provider":{"type":"string","enum":["github"]},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","slug","installationId","type","provider","createdAt"],"additionalProperties":false},"GitRepository":{"type":"object","properties":{"name":{"type":"string"},"private":{"type":"boolean"},"defaultBranch":{"type":"string"},"pushedAt":{"type":"string","format":"date-time"}},"required":["name","private","defaultBranch"],"additionalProperties":false},"AcceptWorkspaceInvitationResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["joined","already-member"]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"workspaceName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["outcome","workspaceId","workspaceName","role"],"additionalProperties":false},"Subject":{"oneOf":[{"$ref":"#/components/schemas/UserSubject"},{"$ref":"#/components/schemas/ServiceAccountSubject"}],"discriminator":{"propertyName":"kind","mapping":{"user":"#/components/schemas/UserSubject","serviceAccount":"#/components/schemas/ServiceAccountSubject"}},"description":"Authenticated principal that can be either a user (with workspace-scoped permissions) or a service account (with configurable scope and role)"},"UserSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["user"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","format":"email","description":"User's email address"},"workspaceId":{"type":"string","description":"ID of the workspace the user is authenticated within"},"workspaceName":{"type":"string","description":"Name of the workspace the user is authenticated within"},"role":{"$ref":"#/components/schemas/UserRole"}},"required":["kind","id","email","workspaceId","role"],"description":"Authenticated user subject with workspace-scoped permissions"},"UserRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"User's role within the workspace","example":"workspace.member"},"ServiceAccountSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["serviceAccount"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique service account identifier (API key ID)"},"workspaceId":{"type":"string","description":"ID of the workspace the service account belongs to"},"workspaceName":{"type":"string","description":"Name of the workspace the service account belongs to"},"scope":{"$ref":"#/components/schemas/SubjectScope"},"role":{"$ref":"#/components/schemas/Role"}},"required":["kind","id","workspaceId","scope","role"],"description":"Authenticated service account subject with scoped permissions (workspace, project, or deployment level)"},"SubjectScope":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["workspace"],"description":"Workspace-scoped access"}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["project"],"description":"Project-scoped access"},"projectId":{"type":"string","description":"ID of the specific project this scope applies to"}},"required":["type","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment"],"description":"Deployment-scoped access"},"deploymentId":{"type":"string","description":"ID of the specific deployment this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"}},"required":["type","deploymentId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"],"description":"Deployment group-scoped access"},"deploymentGroupId":{"type":"string","description":"ID of the specific deployment group this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"}},"required":["type","deploymentGroupId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["manager"],"description":"Manager-scoped access"},"managerId":{"type":"string","description":"ID of the specific manager this scope applies to"}},"required":["type","managerId"]}],"description":"Authorization scope defining what resources this service account can access"},"Role":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"$ref":"#/components/schemas/ProjectRole"},{"$ref":"#/components/schemas/DeploymentRole"},{"$ref":"#/components/schemas/DeploymentGroupRole"},{"$ref":"#/components/schemas/ManagerRole"}],"description":"Role defining what actions this service account can perform within its scope","example":"workspace.member"},"ProjectRole":{"type":"string","enum":["project.viewer","project.developer","project.encryption","project.ai-gateway","project.sandbox-gateway","project.remote-bindings"],"description":"Role for project-scoped service accounts","example":"project.developer"},"DeploymentRole":{"type":"string","enum":["deployment.viewer","deployment.manager","deployment.dynamic-container-manager","deployment.telemetry-writer"],"description":"Role for deployment-scoped service accounts","example":"deployment.manager"},"DeploymentGroupRole":{"type":"string","enum":["deployment-group.deployer"],"description":"Role for deployment group-scoped service accounts","example":"deployment-group.deployer"},"ManagerRole":{"type":"string","enum":["manager.runtime"],"description":"Role for manager-scoped service accounts","example":"manager.runtime"},"ProjectIDOrNamePathParam":{"type":"string","maxLength":100,"description":"Project ID or name."},"Workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name.","example":"my-workspace"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","createdAt"],"additionalProperties":false},"WorkspaceMember":{"type":"object","properties":{"userId":{"type":"string"},"email":{"type":"string"},"name":{"type":"string"},"image":{"type":"string","nullable":true},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"joinedAt":{"type":"string","format":"date-time"}},"required":["userId","email","name","image","role","joinedAt"],"additionalProperties":false},"AgentSettings":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"enabled":{"type":"boolean","description":"Workspace on/off switch for the ai-agent. When `false`, incoming triggers (release/deployment monitoring and Slack-invoked sessions) are rejected before any session runs. Defaults to `true`."},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","enabled","createdAt","updatedAt"],"additionalProperties":false},"UpdateWorkspaceSettingsRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Turn the ai-agent on (`true`) or off (`false`) for this workspace."}}},"WorkspaceInvitation":{"type":"object","properties":{"id":{"type":"string","pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"},"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"status":{"type":"string","enum":["pending","accepted","revoked","expired"]},"deliveryStatus":{"type":"string","enum":["pending","sent","failed"]},"expiresAt":{"type":"string","format":"date-time"},"lastSentAt":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","email","role","status","deliveryStatus","expiresAt","lastSentAt","createdAt","inviteUrl"],"additionalProperties":false},"WorkspaceInviteLink":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"wil_[0-9a-zA-Z]{40}$","description":"Unique identifier for the workspace invite link.","example":"wil_RgcthDSZ37rmFLekuItpFS7btjXoYwou1gE4"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"useCount":{"type":"integer","minimum":0},"lastUsedAt":{"type":"string","format":"date-time","nullable":true},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","role","expiresAt","createdAt","useCount","lastUsedAt","inviteUrl"],"additionalProperties":false},"ProjectListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"deploymentCount":{"type":"number"},"latestRelease":{"$ref":"#/components/schemas/ProjectReleaseInfo"}}}]},"DeploymentPortalAppearancePreset":{"type":"string","enum":["clean","technical","enterprise","playful","minimal"],"default":"clean","description":"Curated visual style for the deployment portal."},"DeploymentPortalAccentColor":{"type":"string","enum":["blue","purple","green","orange","pink","slate"],"default":"blue","description":"Accent color used for highlights and primary actions."},"DeploymentPortalDensity":{"type":"string","enum":["comfortable","compact"],"default":"comfortable","description":"Layout density for portal content."},"ProjectReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","gitMetadata","createdAt"]},"GitMetadata":{"type":"object","nullable":true,"properties":{"commitSha":{"type":"string","nullable":true,"pattern":"^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$","description":"The hash of the commit","example":"dc36199b2234c6586ebe05ec94078a895c707e29"},"commitMessage":{"type":"string","nullable":true,"maxLength":1024,"description":"The commit message","example":"add method to measure Interaction to Next Paint (INP) (#36490)"},"commitRef":{"type":"string","nullable":true,"maxLength":256,"description":"The branch or tag on which the commit was made","example":"main"},"commitDate":{"type":"string","nullable":true,"format":"date-time","description":"The date and time when the commit was created","example":"2026-03-16T12:00:00Z"},"dirty":{"type":"boolean","nullable":true,"description":"Whether or not there have been modifications to the working tree since the latest commit","example":true},"remoteUrl":{"type":"string","nullable":true,"maxLength":2048,"description":"The git repository's remote origin url","example":"https://github.com/alienplatform/alien"},"commitAuthorName":{"type":"string","nullable":true,"maxLength":256,"description":"The name of the author of the commit (from git config)","example":"John Doe"},"commitAuthorEmail":{"type":"string","nullable":true,"maxLength":256,"description":"The author identity recorded by Git. This is not guaranteed to be an RFC-valid email address.","example":"john@example.com"},"commitAuthorLogin":{"type":"string","nullable":true,"maxLength":256,"description":"The provider username of the commit author (e.g., GitHub login), resolved server-side from the commit email","example":"johndoe"},"commitAuthorAvatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"The avatar URL of the commit author, resolved server-side from the provider login","example":"https://github.com/johndoe.png"},"provider":{"$ref":"#/components/schemas/GitProvider"}}},"GitProvider":{"oneOf":[{"$ref":"#/components/schemas/GitHubProvider"},{"$ref":"#/components/schemas/GitLabProvider"},{"nullable":true}],"description":"Provider-specific repository information, resolved server-side from remoteUrl"},"GitHubProvider":{"type":"object","properties":{"type":{"type":"string","enum":["github"]},"org":{"type":"string","maxLength":256,"description":"Repository owner (user or organization)"},"repo":{"type":"string","maxLength":256,"description":"Repository name"}},"required":["type","org","repo"]},"GitLabProvider":{"type":"object","properties":{"type":{"type":"string","enum":["gitlab"]},"namespace":{"type":"string","maxLength":256,"description":"Group/project namespace"},"project":{"type":"string","maxLength":256,"description":"Project name"}},"required":["type","namespace","project"]},"Project":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"projectCapabilities":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"default":null,"required":["schemaVersion","capabilities"],"additionalProperties":false,"description":"Capabilities this Project may offer through setup links."},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","createdAt","workspaceId"]},"ProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","redirectUris"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"hasClientSecret":{"type":"boolean","enum":[true]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","clientId","hasClientSecret","redirectUris"]}]},"GcpOAuthClientId":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[a-zA-Z0-9_-]+-[a-zA-Z0-9_-]+\\.apps\\.googleusercontent\\.com$","description":"Google OAuth web client ID.","example":"1234567890-abc123.apps.googleusercontent.com"},"UpdateProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId"]}]},"GcpOAuthClientSecret":{"type":"string","minLength":1,"maxLength":512,"description":"Google OAuth web client secret. Write-only; never returned by the API.","example":"GOCSPX-example"},"UpdateProject":{"type":"object","properties":{"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"packagesConfigPatch":{"type":"object","properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"additionalProperties":false},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"additionalProperties":false},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"additionalProperties":false},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","nullable":true,"properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"additionalProperties":false}},"additionalProperties":false}},"additionalProperties":false}}},"DeploymentPortalDomainResponse":{"type":"object","properties":{"deploymentPortalEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"},"packageEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["deploymentPortalEndpoint","packageEndpoint"]},"DomainEndpoint":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dend_[0-9a-z]{28}$","description":"Unique identifier for the domain endpoint.","example":"dend_1bb6gdvm1bs74acqkjstcgv"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domainId":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"kind":{"$ref":"#/components/schemas/DomainEndpointKind"},"owner":{"$ref":"#/components/schemas/DomainEndpointOwner"},"hostname":{"type":"string","minLength":1,"maxLength":253},"status":{"$ref":"#/components/schemas/DomainEndpointStatus"},"provider":{"type":"string","nullable":true},"providerState":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"managedDnsRecords":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentPortalManagedDnsRecord"}},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"retryAttempts":{"type":"integer","minimum":0},"nextStepAfter":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","workspaceId","domainId","kind","owner","hostname","status","managedDnsRecords","retryAttempts","createdAt","updatedAt"]},"DomainEndpointKind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"DomainEndpointOwner":{"type":"object","properties":{"type":{"$ref":"#/components/schemas/DomainEndpointOwnerType"},"id":{"type":"string"}},"required":["type","id"]},"DomainEndpointOwnerType":{"type":"string","enum":["workspace","project","manager"]},"DomainEndpointStatus":{"type":"string","enum":["waiting_for_domain","provisioning","waiting_for_dns","waiting_for_health","active","failed","deleting"]},"DeploymentPortalManagedDnsRecord":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"value":{"type":"string"},"ttl":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true}},"required":["name","type","value"]},"DeploymentLinkSetupResponse":{"type":"object","properties":{"activeRelease":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","nullable":true},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true}},"required":["id","version","stack"]},"supportedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"setupItems":{"type":"array","items":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]}},"visiblePackageTypes":{"type":"array","items":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"}},"visibleSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"setupPackagesStatus":{"type":"string","enum":["preparing","ready","failed"],"description":"Whether at least one complete automated setup package is ready across all selected setup items."}},"required":["activeRelease","supportedPlatforms","setupItems","visiblePackageTypes","visibleSetupMethods","setupPackagesStatus"]},"StackByPlatform":{"type":"object","properties":{"aws":{"nullable":true},"gcp":{"nullable":true},"azure":{"nullable":true},"kubernetes":{"nullable":true},"machines":{"nullable":true},"local":{"nullable":true},"test":{"nullable":true}},"additionalProperties":false},"DeploymentSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform","helm","cli","manual"]},"ConfigureModelsRequest":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"minItems":1,"maxItems":100}},"required":["requirements"],"additionalProperties":false},"ProjectCapabilities":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"required":["schemaVersion","capabilities"],"additionalProperties":false},"AIProviderHeaders":{"type":"object","properties":{"providers":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"headers":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"},"value":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7E]*$"}},"required":["name","value"],"additionalProperties":false},"minItems":1,"maxItems":20}},"required":["provider","headers"],"additionalProperties":false},"maxItems":6}},"required":["providers"],"additionalProperties":false},"CapabilityMaterialization":{"type":"object","properties":{"projectCapabilities":{"$ref":"#/components/schemas/ProjectCapabilities"},"source":{"type":"object","properties":{"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"definitionVersion":{"type":"string"},"releaseId":{"type":"string"}},"required":["definitionId","definitionVersion","releaseId"]},"packages":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation","terraform","sandbox-bundle","gcp-sandbox-image"]},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"]}},"required":["type","status"]}}},"required":["projectCapabilities","source","packages"]},"ConfigureRemoteSandboxRequest":{"type":"object","properties":{"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800},"azureIdleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"additionalProperties":false},"SandboxBaseImageRepository":{"type":"object","properties":{"registryHost":{"type":"string","description":"Manager registry host to `docker login` to and push through."},"repository":{"type":"string","description":"This project's repository under that host."}},"required":["registryHost","repository"]},"ProjectCapabilityOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"configurationStatus":{"type":"string","enum":["valid","invalid"]},"hasAppRemoteSandbox":{"type":"boolean"},"summary":{"type":"object","properties":{"groups":{"type":"integer","minimum":0},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"keys":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"registry":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["groups","capabilities"]},"groups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"keys":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"buckets":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"registry":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"remoteSandbox":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["deploymentGroupId","name","externalId","createdAt","capabilities"]}}},"required":["generatedAt","configurationStatus","hasAppRemoteSandbox","summary","groups"]},"RemoteBindingsExternalAccessResponse":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1},"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","format":"uri"}},"required":["deploymentId","resourceId","accessToken","expiresIn","tokenType","managerUrl"]},"RemoteBindingsExternalAccessRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"capability":{"type":"string","enum":["storage","sandbox"]}},"required":["externalId","capability"],"additionalProperties":false},"RemoteOperatorInstallReceipt":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"renderedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","renderedAt"],"additionalProperties":false},"ObservedRemoteOperatorImageIdentity":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"observedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","observedAt"],"additionalProperties":false},"OperationsCatalogKubernetesPermissions":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsRule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false,"description":"Kubernetes RBAC required to execute this operation. Omitted by older servers and null when the operation declares none."},"OperationsCatalogKubernetesPermissionsRule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsVerb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"OperationsCatalogKubernetesPermissionsVerb":{"type":"string","enum":["get","list","watch","delete","patch"]},"RemoteOperatorPermissionPlugin":{"type":"object","properties":{"name":{"type":"string"},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"permissions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["aws","gcp"]},"kubernetesPermissions":{"type":"object","nullable":true,"properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"}},"required":["apiGroup","resource","verbs","reason"]}}},"required":["rules"]}},"required":["name","permissions"]}}},"required":["name","operations"]},"DeploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments allowed in this deployment group"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","externalId","projectId","workspaceId","createdAt"]},"CreateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments in this deployment group"}},"required":["name","project"]},"EnsureDeploymentGroupByNameRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["name","project"]},"EnsureDeploymentGroupByExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["externalId","name","project"]},"CreateSetupLinkResponse":{"allOf":[{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"},{"type":"object","properties":{"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroup"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"The persisted expiration date for the setup link"}},"required":["deploymentGroup","expiresAt"]}]},"CreateDeploymentGroupTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The API key token"},"deploymentLink":{"type":"string","description":"Formatted deployment link"}},"required":["token","deploymentLink"]},"CreateSetupLinkRequest":{"allOf":[{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"},{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"recoveryDeploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Recover Remote Operator bootstrap values for this exact existing group only if it has no deployments. Serialized with registration; never creates or rebinds a group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"}}}]},"DeploymentSetupConfigInput":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}}},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."}}},"DeploymentSetupMetadata":{"type":"object","additionalProperties":{"nullable":true}},"KubernetesClusterSource":{"type":"string","enum":["create","existing"]},"DeploymentSetupStackSettingsPolicy":{"type":"object","properties":{"defaults":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"allowedDeploymentModels":{"type":"array","items":{"type":"string","enum":["push","pull","airgapped"]}},"allowedNetworkModes":{"type":"array","items":{"type":"string","enum":["none","create","default","byo"]}},"allowedUpdatesModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required"]}},"allowedTelemetryModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required","off"]}},"allowedHeartbeatsModes":{"type":"array","items":{"type":"string","enum":["on","off"]}},"allowExternalBindings":{"type":"boolean"},"allowCustomRegistry":{"type":"boolean"}}},"EnvironmentVariableConfig":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"value":{"type":"string","maxLength":10000,"description":"Variable value (encrypted in database)"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","value","type","targetResources"]},"EnvironmentVariableType":{"type":"string","enum":["plain","secret"],"description":"Variable type (plain or secret)"},"DeploymentSetupItemSelection":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":{"type":"boolean"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"Deprecated request shorthand. Use deploymentSetupConfig.policy.allowedAIProviders."}},"required":["item","required"],"additionalProperties":false},"SetupLinkEntryPoint":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"provider":{"oneOf":[{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},{"type":"string","enum":["aws","gcp","azure"]}]}},"required":["item"],"additionalProperties":false,"description":"Portal destination to open first. This controls navigation, not authorization."},"StackInputValuesRequest":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{}},"StackInputValueRequest":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"type":"string"}}]},"ProjectIDOrNameQueryParam":{"type":"string","maxLength":100,"description":"Filter by project ID or name."},"SetDeploymentGroupExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"]},"UpdateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"maxDeployments":{"type":"integer","minimum":1,"description":"Maximum number of deployments in this deployment group"}}},"CreateDeploymentGroupTokenRequest":{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}}},"CreateFirstPartyDeploymentSessionResponse":{"type":"object","properties":{"token":{"type":"string","description":"The deployment-group session token"}},"required":["token"]},"ExternalAIBindingState":{"type":"object","properties":{"binding":{"$ref":"#/components/schemas/ExternalAIBinding"}},"required":["binding"]},"ExternalAIBinding":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"providerClientId":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialRevision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogProviderModelIds":{"type":"array","nullable":true,"items":{"type":"string"}},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"},"requiredModelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"available":{"type":"boolean","nullable":true},"accessStatus":{"type":"string","nullable":true,"enum":["verified","denied",null]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","available","accessStatus","accessObservedAt"]}},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","provider","providerEndpoint","providerClientId","keyFingerprint","credentialRevision","credentialStatus","credentialCheckedAt","catalogProviderModelIds","catalogObservedAt","requiredModelCoverage","updatedAt"]},"PutExternalAIBindingRequest":{"oneOf":[{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","openai"]},"apiKey":{"type":"string","minLength":1,"maxLength":512},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","apiKey","acknowledgeAlienCredentialAccess"],"additionalProperties":false},{"type":"object","properties":{"provider":{"type":"string","enum":["databricks"]},"workspaceUrl":{"type":"string","minLength":1,"maxLength":512},"clientId":{"type":"string","minLength":1,"maxLength":512},"clientSecret":{"type":"string","minLength":1,"maxLength":4096},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","workspaceUrl","clientId","clientSecret","acknowledgeAlienCredentialAccess"],"additionalProperties":false}]},"ExternalAIModelCheck":{"type":"object","properties":{"id":{"type":"string"},"publicModel":{"type":"string"},"status":{"type":"string","enum":["pending","running","verified","denied","failed","cancelled"]},"blockerCode":{"type":"string","nullable":true},"error":{"nullable":true},"requestedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","publicModel","status","blockerCode","requestedAt","completedAt"]},"ContainerRegistryState":{"type":"object","properties":{"route":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]},"endpoint":{"type":"object","nullable":true,"properties":{"url":{"type":"string","format":"uri"},"source":{"type":"string","enum":["runtime","custom-domain"]}},"required":["url","source"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]}}},"required":["route","endpoint","repositories","credentials"]},"CreateContainerRegistryCredentialResponse":{"type":"object","properties":{"credential":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]},"username":{"type":"string","enum":["alien"]},"password":{"type":"string"}},"required":["credential","username","password"]},"Package":{"type":"object","properties":{"id":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"type":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string","description":"Package version (e.g., '1.0.0', 'rel_abc123')"},"sourceReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release used as package build input. Null for release-less packages such as Operate Operator images.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"dependsOnPackageId":{"type":"string","nullable":true,"pattern":"pkg_[0-9a-z]{28}$","description":"Exact package dependency used as build input. Helm packages use this to identify the Operator image embedded in the chart.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"setupFingerprints":{"$ref":"#/components/schemas/SetupFingerprintMap"},"packageBuildInputHash":{"type":"string","description":"Hash of Platform-known package build request inputs: package type, source release, setup fingerprints, package config, and setup contract version"},"config":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"}},"required":["displayName","name"],"description":"Branding configuration for the deploy CLI binary."},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package paired with managed Kubernetes setup artifacts.\n\nThis is derived by the platform and is independent from the generic dependency, which\ncan point at a sandbox bundle for a mixed AWS and Kubernetes release."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for CloudFormation packages"},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image the agent binary is read from."},"baseImage":{"type":"string","description":"`custom_image` resolved to its linux/amd64 manifest, `registry/repository@sha256:...`."},"customImage":{"type":"string","description":"The developer's image as typed, which ties the package to the capability that asked."},"managerUrl":{"type":"string","description":"URL of the GCP manager whose registry proxy receives the push."}},"required":["agentImage","baseImage","customImage","managerUrl"],"description":"Configuration for a GCP sandbox image package.\n\nThe image is the developer's base with the sandbox agent and its contract layered on, pushed\ninto the project's path of the GCP manager's registry."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"managerUrl":{"type":"string","description":"Resolved default management endpoint captured when this build was queued."},"operationPermissions":{"type":"array","nullable":true,"items":{"type":"object","properties":{"operation":{"type":"string","description":"Operation name within the plugin."},"permissions":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Kubernetes API group. An empty string denotes the core API."},"reason":{"type":"string","description":"Human-readable reason the operation requires this rule."},"resource":{"type":"string","description":"Plural Kubernetes resource, optionally with a supported subresource."},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Optional concrete resource names. Empty means all names in the installation scope."},"verbs":{"type":"array","items":{"type":"string"},"description":"Concrete Kubernetes API verbs required by the operation."}},"required":["apiGroup","reason","resource","verbs"],"description":"One Kubernetes API requirement declared by an enabled operation."},"description":"Explicit Kubernetes API requirements."},"schemaVersion":{"type":"integer","minimum":0,"description":"Schema version of the validated permission declaration."}},"required":["rules","schemaVersion"],"description":"Versioned Kubernetes API requirements declared by an enabled operation."},"plugin":{"type":"string","description":"Operations plugin name."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier of an enabled operation in a Helm build snapshot."}},"required":["operation","permissions","plugin","tier"],"description":"Canonical Kubernetes permission snapshot for one enabled operation."},"description":"Canonical Kubernetes permissions for the operations enabled when this build was queued.\n\nThis is derived by the platform and persisted with the build request. It is not part of\nthe user-authored project package configuration. `None` identifies an older package row\nthat must be re-enqueued; an empty `Some` is a reviewed snapshot with no extra grants."},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","description":"Existing namespace claim instead of creating a new claim."},"size":{"type":"string","description":"Requested claim capacity, for example 1Gi."},"storageClassName":{"type":"string","description":"Cluster storage class; empty uses the cluster default."}},"required":["enabled","existingClaim","size","storageClassName"],"description":"Operator identity storage in the generated chart. This does not install a storage driver."},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","description":"Data key inside the Secret."},"name":{"type":"string","description":"Fixed Kubernetes Secret name expected by the workload's Secret mount."},"prefix":{"type":"string","description":"Plaintext prefix before the random alphanumeric suffix."},"randomLength":{"type":"integer","minimum":0,"description":"Length of the random suffix."}},"required":["key","name","prefix","randomLength"],"description":"Non-secret configuration for a chart-generated enrollment token."},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Empty string for the core Kubernetes API group."},"resources":{"type":"array","items":{"type":"string"},"description":"Kubernetes plural resource names; wildcards are not accepted."}},"required":["apiGroup","resources"],"description":"Resource family the chart grants get/list/watch over."},"description":"Exact API groups and resources. Verbs are fixed to get/list/watch."},"serviceAccountProfile":{"type":"string","description":"Permission profile used by the workload Container and generated ServiceAccount."}},"required":["rules","serviceAccountProfile"],"description":"Cluster reads granted to a workload identity, separate from Operator permissions."}},"required":["tokenSecret","workloadReadAccess"],"description":"Kubernetes resources created by the product chart before the runtime starts."}},"required":["chartName","description"],"description":"Configuration for the Helm chart package"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"}},"required":["displayName","name"],"description":"Branding configuration for the Operator image."},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image copied into the bundle."},"baseImage":{"type":"string","description":"The base container image the sandbox filesystem starts from. A release-pushed image\narrives resolved onto the private registry template with its {region} token intact."},"objectKey":{"type":"string","description":"Object key the bundle is written under in every regional bundle store."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store must receive this bundle. Part of the build input hash,\nso a newly supported region re-mints the bundle instead of silently missing it."}},"required":["agentImage","baseImage","objectKey"],"description":"Configuration for a sandbox bundle package.\n\nThe bundle is a zip holding one Dockerfile that layers the published Alien sandbox agent\nonto the vendor's base image; everything the builder writes is derived from these fields."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package used to compose managed Kubernetes modules.\n\nThis is derived by the platform and persisted with the build request. It is separate\nfrom the generic package dependency because a mixed AWS and Kubernetes release can also\ndepend on a sandbox bundle."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for Terraform package generation."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]}],"description":"Type-specific configuration"},"outputs":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"digest":{"type":"string","description":"Image digest (e.g., \"sha256:abc123...\")"},"image":{"type":"string","description":"Full image reference (e.g., \"public.ecr.aws/acme/operators/project-id:1.2.3\")"},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain packaged into the Operator image, if whitelabeled."}},"required":["digest","image"],"description":"Outputs from an Operator image package build"},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentDigest":{"type":"string","description":"Manifest digest of the linux/amd64 agent image the agent binary came from."},"baseDigest":{"type":"string","description":"Manifest digest of the linux/amd64 base the image was built from."},"digest":{"type":"string","description":"Manifest digest of the pushed image."},"image":{"type":"string","description":"Native registry reference pinned by digest, the value a GCP sandbox stack names."},"reuseKey":{"type":"string","description":"Hash of the base digest, the agent image reference and the image contract; equal keys reuse."}},"required":["agentDigest","baseDigest","digest","image","reuseKey"],"description":"Outputs from a GCP sandbox image package build."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"bundleUriTemplate":{"type":"string","description":"Bundle URI with the {region} token in the bucket, resolved by the deploy-time emitters."},"objectKey":{"type":"string","description":"Object key the bundle was written under in every regional bundle store."},"regions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store received this bundle."},"sha256":{"type":"string","description":"SHA256 checksum of the region-neutral bundle zip; a region-templated base image makes\neach regional object differ from it only in the rendered region."},"size":{"type":"integer","minimum":0,"description":"Region-neutral bundle zip size in bytes."}},"required":["bundleUriTemplate","objectKey","regions","sha256","size"],"description":"Outputs from a sandbox bundle package build."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]},{"nullable":true}],"description":"Package outputs (only when status is 'ready')"},"error":{"nullable":true,"description":"Error information if status is 'failed'"},"sourceBinarySha256":{"type":"string","nullable":true,"description":"Builder-recorded source binary SHA256 (for cli/terraform packages)"},"retries":{"type":"integer","minimum":0,"description":"Number of build retries"},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"leaseExpiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Expiration of the current builder lease"},"buildPhase":{"type":"string","nullable":true,"enum":["building","publishing",null],"description":"Coarse package build phase"},"lastProgressAt":{"type":"string","format":"date-time","nullable":true,"description":"Last successful builder lease renewal or phase change"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","projectId","workspaceId","type","status","version","setupFingerprints","packageBuildInputHash","config","retries","createdAt","updatedAt"]},"SetupFingerprintMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/SetupFingerprintInfo"},"description":"Per-target setup compatibility fingerprints copied from the source release"},"SetupFingerprintInfo":{"type":"object","properties":{"target":{"$ref":"#/components/schemas/SetupTarget"},"fingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"version":{"$ref":"#/components/schemas/SetupFingerprintVersion"}},"required":["target","fingerprint","version"]},"SetupTarget":{"type":"string","minLength":1,"description":"Stable target key for the setup contract, e.g. aws/us-east-1"},"SetupFingerprint":{"type":"string","minLength":1,"description":"Deterministic setup contract fingerprint for one setup target"},"SetupFingerprintVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup fingerprint algorithm version"},"ReleaseListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Release"},{"type":"object","properties":{"currentChannels":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannelName"},"description":"Channels for which this release is currently selected"},"commitUrl":{"type":"string","nullable":true,"format":"uri","description":"Validated canonical provider URL for the exact commit"},"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"rollout":{"type":"object","nullable":true,"properties":{"updatedCount":{"type":"integer","description":"Deployments that finished updating to this release (excludes initial provisions)"},"pendingCount":{"type":"integer","description":"Deployments currently targeting this release but not yet running it"},"avgDurationMs":{"type":"number","nullable":true,"description":"Average time from release creation until a deployment finished updating, in milliseconds"}},"required":["updatedCount","pendingCount","avgDurationMs"],"description":"Rollout stats, included when ?include=rollout is used"},"createdBy":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"User ID"},"name":{"type":"string","description":"User's display name"},"email":{"type":"string","description":"User's email address"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"}},"required":["id","name","email","image"],"description":"Platform user who created the release, included when ?include=createdBy is used"}},"required":["currentChannels","commitUrl"]}]},"ReleaseChannelName":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$"},"Release":{"type":"object","properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"projectId":{"type":"string","maxLength":128},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true},"setupFingerprints":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintMap"},{"description":"Per-target setup compatibility fingerprints for this release"}]},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"createdByUserId":{"type":"string","nullable":true,"maxLength":128,"description":"ID of the platform user who created the release, if known"},"workspaceId":{"type":"string","maxLength":128}},"required":["id","projectId","version","createdAt","setupFingerprints","workspaceId"]},"CreateReleaseRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"stack":{"$ref":"#/components/schemas/StackByPlatform"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"channel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Release channel to advance. Defaults to production."}]}},"required":["project"]},"ReleaseAuthorFilterItem":{"type":"object","properties":{"login":{"type":"string","nullable":true,"description":"Provider username (e.g., GitHub login)"},"name":{"type":"string","nullable":true,"description":"Git commit author name"},"avatarUrl":{"type":"string","nullable":true,"format":"uri","description":"Author avatar URL"}},"required":["login","name","avatarUrl"]},"ReleaseDeploymentsResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseDeploymentItem"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"},"stateCounts":{"$ref":"#/components/schemas/ReleaseRolloutStateCounts"}},"required":["items","nextCursor","stateCounts"]},"ReleaseDeploymentItem":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"deploymentGroup":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"],"description":"Deployment group this deployment belongs to"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"rolloutState":{"$ref":"#/components/schemas/ReleaseRolloutState"},"releasedAt":{"type":"string","format":"date-time","nullable":true,"description":"When this release went live on the deployment, null if it never did"},"durationMs":{"type":"integer","nullable":true,"description":"Time from release creation until the deployment finished updating, in milliseconds. Null for initial provisions and deployments that never ran this release."},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"}},"required":["id","name","status","platform","rolloutState","releasedAt","durationMs"]},"ReleaseRolloutState":{"type":"string","enum":["updated","updating","failed","pending","pinned-other","superseded","on-other"]},"ReleaseRolloutStateCounts":{"type":"object","properties":{"updated":{"type":"integer"},"updating":{"type":"integer"},"failed":{"type":"integer"},"pending":{"type":"integer"},"pinned-other":{"type":"integer"},"superseded":{"type":"integer"},"on-other":{"type":"integer"}},"required":["updated","updating","failed","pending","pinned-other","superseded","on-other"],"description":"Deployment counts per rollout state across all deployments the filters allow (ignores the state filter)"},"ReleaseChannel":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"deploymentCount":{"type":"integer","minimum":0},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","projectId","name","currentReleaseId","createdAt","updatedAt"]},"DeploymentListItemResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if in a failed state"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"$ref":"#/components/schemas/ManagerID"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentProtocolVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"DeploymentState protocol version owned by the runtime/manager"},"DeploymentPurpose":{"type":"string","enum":["application","encryption","ai","storage","container-registry","sandbox"],"description":"Operational purpose of this deployment within its customer environment."},"OperatorCapabilityReport":{"type":"object","properties":{"key":{"type":"string","minLength":1,"maxLength":128},"state":{"$ref":"#/components/schemas/OperatorCapabilityState"},"detail":{"type":"string","nullable":true,"maxLength":512}},"required":["key","state"]},"OperatorCapabilityState":{"type":"string","enum":["granted","denied","unavailable"]},"ManagerID":{"type":"string","pattern":"mgr_[0-9a-z]{28}$","description":"ID of the manager","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"DeploymentReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","minLength":1,"maxLength":256},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","version","createdAt"]},"DeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"]},"DeploymentProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"}},"required":["id","name"]},"DeploymentStats":{"type":"object","properties":{"total":{"type":"number","description":"Total number of deployments matching filters"},"byStatus":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by status (only includes statuses with non-zero counts)"},"byPlatform":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by platform (only includes platforms with non-zero counts)"},"byCurrentRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by currentReleaseId. The empty string key represents deployments with no current release (initial provisioning)."},"byPinnedRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by pinnedReleaseId among deployments that are pinned. Excludes unpinned deployments."},"byOrigin":{"type":"object","properties":{"framework":{"type":"number"},"remoteOperator":{"type":"number"}},"description":"Count of deployments introduced through each deployment path."}},"required":["total","byStatus","byPlatform","byCurrentRelease","byPinnedRelease","byOrigin"]},"DeploymentDetailResponse":{"allOf":[{"$ref":"#/components/schemas/Deployment"},{"type":"object","properties":{"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"},"operatorSync":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dosy_[0-9a-z]{28}$","description":"Unique identifier for the deployment operator sync.","example":"dosy_uxveigz3biyrosqycaqubbr"},"status":{"$ref":"#/components/schemas/DeploymentOperatorSyncStatus"},"stuckReason":{"$ref":"#/components/schemas/DeploymentOperatorSyncStuckReason"},"statusMessage":{"type":"string","nullable":true,"description":"Human-readable explanation of the status"},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash last reported by the Operator"},"missingOperations":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Expected `plugin/operation` names not reported by the Operator (catalog-mismatch only)"},"plugins":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/DeploymentOperatorSyncPlugin"},"description":"Enabled plugins compared with what the Operator last reported loading. Null when the sync fingerprints cannot be read."},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","targetBundleHash","targetSetAt"],"description":"Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments."}}}]},"ReportedOperation":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"name":{"type":"string","minLength":1,"maxLength":128}},"required":["plugin","pluginVersion","name"]},"DeploymentUpdateOperationSummary":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"status":{"$ref":"#/components/schemas/DeploymentUpdateOperationStatus"},"reasons":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentUpdateReason"}},"targetReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"changedKeys":{"type":"array","items":{"type":"string"}},"actionRequired":{"type":"string","nullable":true,"description":"Action needed before this update can execute; the current release remains installed."},"requestedAt":{"type":"string","format":"date-time"},"startedAt":{"type":"string","format":"date-time","nullable":true},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","reasons","targetReleaseId","changedKeys","requestedAt"]},"DeploymentUpdateOperationStatus":{"type":"string","enum":["blocked","queued","applying","succeeded","failed","superseded"]},"DeploymentUpdateReason":{"type":"string","enum":["configuration","redeploy","release"]},"DeploymentOperatorSyncStatus":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"DeploymentOperatorSyncStuckReason":{"type":"string","nullable":true,"enum":["download-failed","sync-stalled","catalog-mismatch",null]},"DeploymentOperatorSyncPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string","description":"Version the Operator should run"},"source":{"type":"string","enum":["builtin","custom"]},"state":{"type":"string","enum":["running","adding","updating","removing"],"description":"What the Operator still has to do for this plugin"},"previousVersion":{"type":"string","nullable":true,"description":"Version the Operator is running now (only while updating)"}},"required":["name","version","source","state"]},"Deployment":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentConnectionInfo":{"type":"object","properties":{"arc":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Manager URL for commands"},"deploymentId":{"type":"string","description":"Deployment ID to use in command requests"}},"required":["url","deploymentId"]},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"publicEndpoints":{"type":"object","additionalProperties":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"protocol":{"type":"string","enum":["http","tcp"]},"host":{"type":"string","minLength":1},"port":{"type":"integer","minimum":1,"maximum":65535},"wildcardHost":{"type":"string"}},"required":["url","protocol","host","port"]},"description":"Public endpoints keyed by endpoint name."}},"required":["type"]},"description":"Deployed resources and their public endpoints"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string"}},"required":["arc","resources","status","platform"]},"CreateDeploymentResponse":{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/Deployment"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Effective deployment model persisted for the deployment."},"token":{"type":"string","description":"Deployment token (only returned when using deployment group token)"}},"required":["deployment","deploymentModel"]},"NewDeploymentRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentGroupId":{"type":"string","description":"Required for workspace/project tokens. Deployment group tokens use their own group automatically."},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Optional manager to assign. If omitted, the project default or system manager is selected."}]},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"environmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"},"description":"Configuration of environment variables for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"Stack settings for deployment customization"},"resourcePrefix":{"$ref":"#/components/schemas/ResourcePrefix"},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method that created the deployment. Defaults to cli."}]},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup method metadata used to guide privileged teardown."}]},"inputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{},"description":"Stack input values provided by the deployment creator."},"operatorScope":{"type":"string","minLength":1,"maxLength":512,"description":"Display-only scope reported by the Operator manifest."},"operatorPermission":{"type":"string","minLength":1,"maxLength":64,"description":"Display-only permission tier reported by the Operator manifest."},"initialDesiredRelease":{"type":"string","enum":["active","none"],"default":"active","description":"Desired-release selection for a new deployment. Use none to register an environment without initially requesting a release; later updates can assign one."},"releaseChannel":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","default":"production","description":"Release channel followed while this deployment is not pinned."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Customer setup item selected from this deployment-group token."},"setupHandoff":{"type":"string","enum":["immediate","await-registration"],"default":"immediate","description":"Use await-registration when CloudFormation will create the infrastructure and register this deployment."}},"required":["name","platform","project"],"additionalProperties":false,"description":"Request schema for creating a new deployment"},"ResourcePrefix":{"type":"string","pattern":"^[a-z](?:[a-z0-9]|-(?=[a-z0-9])){1,38}[a-z0-9]$","description":"Optional physical-name prefix for generated cloud resources. Omit to let the manager generate one."},"ImportDeploymentRequest":{"oneOf":[{"$ref":"#/components/schemas/ForwardImportRequest"},{"$ref":"#/components/schemas/PersistImportedDeploymentRequest"}],"description":"Request schema for importing a deployment from resolved setup infrastructure"},"ForwardImportRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["forward"],"default":"forward"},"project":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user-session callers."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Required for user-session callers. Deployment-group tokens use their own group automatically.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager ID. If omitted, the first suitable manager for the source platform is used."}]},"source":{"$ref":"#/components/schemas/ImportSource"},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Exact item selected from a tailored customer setup link."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["source"]},"ImportSource":{"type":"object","properties":{"deploymentName":{"type":"string","minLength":1,"description":"User-chosen deployment name. Must be unique within the deployment group; the manager returns 409 on collision."},"resourcePrefix":{"allOf":[{"$ref":"#/components/schemas/ResourcePrefix"},{"description":"Stable physical-name prefix used by the setup artifact."}]},"sourceKind":{"$ref":"#/components/schemas/ImportSourceKind"},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup source metadata needed to guide privileged teardown."}]},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release that produced the setup artifact. Defaults to latest.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Cloud platform of the imported stack"},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"region":{"type":"string","description":"Region or location reported by the setup artifact"},"setupTarget":{"allOf":[{"$ref":"#/components/schemas/SetupTarget"},{"description":"Setup target this package was generated for"}]},"setupImportFormatVersion":{"$ref":"#/components/schemas/SetupImportFormatVersion"},"setupFingerprint":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprint"},{"description":"Setup compatibility fingerprint embedded in the package"}]},"setupFingerprintVersion":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintVersion"},{"description":"Setup fingerprint algorithm version embedded in the package"}]},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ImportedResource"},"minItems":1}},"required":["deploymentName","resourcePrefix","platform","region","setupTarget","setupImportFormatVersion","setupFingerprint","setupFingerprintVersion","stackSettings","resources"],"description":"Resolved setup import payload"},"ImportSourceKind":{"type":"string","enum":["cloudformation","terraform","helm"],"description":"Source label for observability only — does not affect import behavior."},"KubernetesBasePlatform":{"type":"string","enum":["aws","gcp","azure"],"description":"Base cloud platform for cloud-backed Kubernetes imports."},"SetupImportFormatVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup import payload format version embedded in the package"},"ImportedResource":{"type":"object","properties":{"id":{"type":"string","description":"Resource id from the active stack"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"importData":{"type":"object","additionalProperties":{"nullable":true},"description":"Resolved typed import payload"}},"required":["id","type","importData"]},"PersistImportedDeploymentRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["persist"]},"name":{"type":"string","minLength":1,"description":"Deployment name. Must be unique within the deployment group."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"stackState":{"nullable":true},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"runtimeMetadata":{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},"scheduleReconciliation":{"type":"boolean","default":false},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"default":"provisioning","description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"currentReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"importSource":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"setupMetadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"setupTarget":{"$ref":"#/components/schemas/SetupTarget"},"setupFingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"setupFingerprintVersion":{"$ref":"#/components/schemas/SetupFingerprintVersion"},"deploymentToken":{"type":"string"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["mode","name","deploymentGroupId","managerId","platform","stackSettings","runtimeMetadata","deploymentProtocolVersion","setupTarget","setupFingerprint","setupFingerprintVersion"]},"SetFirstPartyDeploymentInputsResponse":{"type":"object","properties":{"ok":{"type":"boolean"}},"required":["ok"]},"SetFirstPartyDeploymentInputsRequest":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"releaseChannel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["platform"]},"SetupRegistrationOperationResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"status":{"$ref":"#/components/schemas/SetupRegistrationOperationStatus"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"physicalResourceId":{"type":"string","nullable":true},"result":{"$ref":"#/components/schemas/SetupRegistrationOperationResult"},"error":{"type":"object","nullable":true,"properties":{"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["message","retryable"]}},"required":["id","action","sourceKind","status","deploymentId","physicalResourceId","result","error"]},"SetupRegistrationAction":{"type":"string","enum":["create","update","delete"]},"SetupRegistrationOperationStatus":{"type":"string","enum":["pending","processing","waiting-for-handoff","succeeded","failed","responding","responded"]},"SetupRegistrationOperationResult":{"type":"object","nullable":true,"properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentToken":{"type":"string","nullable":true},"helmValues":{"type":"string","nullable":true}},"required":["deploymentId","deploymentToken","helmValues"]},"CreateSetupRegistrationOperationRequest":{"type":"object","properties":{"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"source":{"allOf":[{"$ref":"#/components/schemas/ImportSource"}],"nullable":true},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":512},"cloudFormation":{"$ref":"#/components/schemas/SetupRegistrationCloudFormationTarget"}},"required":["action","sourceKind"],"additionalProperties":false},"SetupRegistrationCloudFormationTarget":{"type":"object","nullable":true,"properties":{"stackId":{"type":"string","minLength":1},"requestId":{"type":"string","minLength":1},"logicalResourceId":{"type":"string","minLength":1},"responseUrl":{"type":"string","format":"uri"},"physicalResourceId":{"type":"string","nullable":true,"minLength":1},"serviceTimeoutSeconds":{"type":"integer","minimum":60,"maximum":7200,"default":3300}},"required":["stackId","requestId","logicalResourceId","responseUrl"],"additionalProperties":false},"DeleteDeploymentResponse":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]},"message":{"type":"string"}},"required":["action","message"]},"DeleteDeploymentRequest":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]}},"required":["action"]},"PinReleaseRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release ID to pin the deployment to. Set to null to resume its followed channel.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for pinning/unpinning deployment release"},"DeploymentInputsResponse":{"type":"object","properties":{"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"values":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"description":"Current non-secret input values. Secret values are never returned."},"providedInputIds":{"type":"array","items":{"type":"string"},"description":"Input IDs that currently have a value, including redacted secrets."}},"required":["inputs","values","providedInputIds"]},"UpdateDeploymentComputeRequest":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]}}},"UpdateDeploymentInputsResponse":{"allOf":[{"$ref":"#/components/schemas/DeploymentInputsResponse"},{"type":"object","properties":{"runtimeUpdateRequested":{"type":"boolean"},"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["runtimeUpdateRequested","outcome","operation"]}]},"UpdateDeploymentInputsRequest":{"type":"object","properties":{"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"clearInputIds":{"type":"array","items":{"type":"string"},"default":[]}},"additionalProperties":false},"UpdateDeploymentEnvironmentVariablesRequest":{"type":"object","properties":{"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"value":{"type":"string","description":"Variable value"},"type":{"type":"string","enum":["plain","secret"],"description":"Variable type"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources)"}},"required":["name","value","type"]},"description":"Environment variables for the deployment"}},"required":["variables"],"additionalProperties":false,"description":"Request schema for updating deployment environment variables"},"CreateDeploymentTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The generated deployment token (only shown once)"},"deploymentId":{"type":"string","description":"The deployment ID that this token is scoped to"}},"required":["token","deploymentId"]},"CreateDeploymentTokenRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128,"description":"Optional description for the deployment token"},"expiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Optional expiration date for the deployment token"}},"required":["description"]},"DynamicContainerResponse":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"appliedGeneration":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"statusMessage":{"type":"string","nullable":true},"internalServices":{"type":"array","items":{"type":"object","properties":{"internalDns":{"type":"string"},"port":{"type":"integer"}},"required":["internalDns","port"]}},"deleted":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["name","spec","generation","appliedGeneration","status","statusMessage","internalServices","deleted","createdAt","updatedAt"]},"DynamicContainerName":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"DynamicContainerSpec":{"type":"object","properties":{"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"resources":{"type":"object","properties":{"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"}},"required":["cpu","memory"]},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192},"default":{}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]}},"required":["image","resources","replicas","ports"],"additionalProperties":false},"PutDynamicContainerRequest":{"type":"object","properties":{"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}}},"required":["spec"],"additionalProperties":false},"ListDeploymentMachinesResponse":{"type":"object","properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentMachine"}}},"required":["machines"]},"DeploymentMachine":{"type":"object","properties":{"clusterResourceId":{"type":"string"},"machineId":{"type":"string"},"status":{"type":"string"},"capacityGroup":{"type":"string"},"zone":{"type":"string"},"cpu":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"memory":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"storage":{"type":"object","nullable":true,"properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"workloadId":{"type":"string","nullable":true},"workloadName":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true},"schedulingMode":{"type":"string","nullable":true},"state":{"type":"string","nullable":true}},"required":["reason"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"overlayIp":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"horizondVersion":{"type":"string","nullable":true},"networkHealth":{"type":"string","enum":["unknown","healthy","degraded"]},"wireguardMesh":{"type":"object","nullable":true,"properties":{"expectedPeerCount":{"type":"integer","minimum":0},"reachablePeerCount":{"type":"integer","minimum":0},"missingPeerMachineIds":{"type":"array","items":{"type":"string"}}},"required":["expectedPeerCount","reachablePeerCount","missingPeerMachineIds"]},"wireguardMeshObservedAt":{"type":"string","nullable":true},"localOverrides":{"type":"array","items":{"type":"object","properties":{"activeDigest":{"type":"string","nullable":true},"actor":{"type":"string","nullable":true},"baseAssignmentHash":{"type":"string"},"baseDigest":{"type":"string","nullable":true},"candidateDigest":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"failureCategory":{"type":"string","nullable":true},"fallbackDigest":{"type":"string","nullable":true},"forcedStop":{"type":"boolean","nullable":true},"healthySince":{"type":"string","nullable":true},"incidentId":{"type":"string","nullable":true},"lifecycle":{"type":"string"},"phaseStartedAt":{"type":"string","nullable":true},"replicaId":{"type":"string"},"workloadName":{"type":"string"}},"required":["baseAssignmentHash","lifecycle","replicaId","workloadName"]}},"localOverridesObservedAt":{"type":"string","nullable":true},"replicaCount":{"type":"integer"}},"required":["clusterResourceId","machineId","status","capacityGroup","zone","cpu","memory","drainBlockers","drainForce","lastHeartbeat","localOverrides","replicaCount"]},"DeploymentCredentialRotationStatus":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0},"rotation":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}},"required":["deploymentId","revision","rotation"]},"DeploymentCredentialRotation":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"expiresAt":{"type":"string"}},"required":["id","revision","status","expiresAt"]},"DeploymentCredentialRotationValues":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"token":{"type":"string"}},"required":["deploymentId","revision","token"]},"CreateManagerResponse":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["pending"]},"setupToken":{"type":"string"},"setupTokenId":{"type":"string"},"deploymentLink":{"type":"string"},"setupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"inputValues":{"$ref":"#/components/schemas/EncryptedStackInputValues"},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8,"description":"Immutable setup items and exact sources captured when this setup link is created."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string","enum":["plain","secret"]},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"}}},"required":["name","type","targetResources"]}}},"required":["metadata","policy","environmentVariables"]},"setup":{"oneOf":[{"type":"object","properties":{"method":{"type":"string","enum":["cloudformation"]},"deploymentPortalUrl":{"type":"string"},"launchUrl":{"type":"string"},"templateUrl":{"type":"string"},"stackName":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","launchUrl","templateUrl","stackName","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["google-oauth"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"oauthStartUrl":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","oauthStartUrl","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["terraform"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"providerSource":{"type":"string"},"moduleSource":{"type":"string"},"moduleVersion":{"type":"string"},"moduleInputs":{"type":"object","additionalProperties":{"type":"string"}},"mainTf":{"type":"string"},"tfvars":{"type":"string"},"commands":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","providerSource","moduleSource","moduleInputs","mainTf","tfvars","commands","stackSettings"]}]}},"required":["managerId","setupStatus","setupToken","setupTokenId","deploymentLink","setupConfig","setup"]},"DeploymentSetupPolicy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}},"required":["allowedPlatforms","allowedSetupMethods"]},"EncryptedStackInputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/EncryptedStackInputValue"},"default":{}},"EncryptedStackInputValue":{"type":"object","properties":{"value":{"type":"string","description":"Encrypted JSON-encoded input value."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"]},"secret":{"type":"boolean","description":"Whether the original input is secret."}},"required":["value","kind","secret"]},"NewManagerRequest":{"type":"object","properties":{"name":{"type":"string"},"cloud":{"$ref":"#/components/schemas/PrivateManagerCloud"},"region":{"type":"string","minLength":1,"maxLength":64,"description":"Cloud region for the manager."},"setupMethod":{"$ref":"#/components/schemas/PrivateManagerSetupMethod"},"network":{"type":"string","enum":["create","default"],"description":"Optional network mode for the private-manager setup. Defaults to create for production isolation; default uses the provider default network for faster dev/test setup."},"otlpConfig":{"type":"object","properties":{"logsEndpoint":{"type":"string","format":"uri","description":"External OTLP logs endpoint (e.g. https://api.axiom.co/v1/logs)"},"logsAuthHeader":{"type":"string","description":"Auth header in 'key=value,...' format (e.g. 'authorization=Bearer <token>,x-axiom-dataset=<dataset>')"}},"required":["logsEndpoint","logsAuthHeader"],"description":"Optional external OTLP config for forwarding logs to Axiom, Datadog, etc. Falls back to built-in DeepStore when not set."}},"required":["name","cloud","region"]},"PrivateManagerCloud":{"type":"string","enum":["aws","gcp","azure"],"description":"Cloud where the private manager will be deployed."},"PrivateManagerSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform"],"description":"Optional setup method. Defaults to cloudformation for AWS, google-oauth for GCP, and terraform for Azure."},"ManagerRetryResponse":{"oneOf":[{"allOf":[{"$ref":"#/components/schemas/CreateManagerResponse"},{"type":"object","properties":{"mode":{"type":"string","enum":["setup"]}},"required":["mode"]}]},{"$ref":"#/components/schemas/ManagerRetryDeploymentResponse"}]},"ManagerRetryDeploymentResponse":{"type":"object","properties":{"mode":{"type":"string","enum":["deployment"]},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["provisioning"]},"deploymentId":{"type":"string"},"message":{"type":"string"}},"required":["mode","managerId","setupStatus","deploymentId","message"]},"Manager":{"type":"object","properties":{"id":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for the manager"}]},"name":{"type":"string","description":"Display name of the manager"},"targets":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms this manager can handle"},"cloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where this private manager is deployed"},"region":{"type":"string","nullable":true,"description":"Cloud region selected for this private manager"},"setupStatus":{"type":"string","nullable":true,"enum":["pending","provisioning","active","failed","deleting","deleted",null],"description":"Private manager setup lifecycle status"},"url":{"type":"string","nullable":true,"format":"uri","description":"Manager URL (self-reported via heartbeat). DeepStore endpoints are exposed through this URL (e.g., {url}/v1/logs)"},"managementConfigs":{"$ref":"#/components/schemas/ManagerManagementConfigs"},"isSystem":{"type":"boolean","description":"Whether this is a system manager (Alien-hosted)"},"workspaceId":{"type":"string","description":"The workspace ID (for system managers, this is ALIEN_WORKSPACE_ID)"},"status":{"$ref":"#/components/schemas/ManagerStatus"},"version":{"type":"string","nullable":true,"description":"Manager version (self-reported via heartbeat)"},"metrics":{"type":"object","nullable":true,"properties":{"activeDeployments":{"type":"number","description":"Number of active deployments"},"pendingDeployments":{"type":"number","description":"Number of pending deployments"},"memoryUsageMb":{"type":"number","description":"Memory usage in megabytes"},"cpuUsagePercent":{"type":"number","description":"CPU usage percentage"}},"description":"Runtime metrics (self-reported via heartbeat)"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the manager"},"logsDatabaseId":{"type":"string","nullable":true,"description":"ID of the logs database associated with this manager"},"managedDeploymentCount":{"type":"integer","minimum":0,"description":"Number of deployments currently being managed by this manager"},"defaultProjectCount":{"type":"integer","minimum":0,"description":"Number of projects that select this manager as a default manager"},"createdAt":{"type":"string","format":"date-time","description":"Timestamp when the manager was created"}},"required":["id","name","targets","managementConfigs","isSystem","workspaceId","status","managedDeploymentCount","defaultProjectCount","createdAt"],"description":"Manager schema"},"ManagerManagementConfigs":{"type":"object","properties":{"aws":{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"},"platform":{"type":"string","enum":["aws"]}},"required":["managingRoleArn","platform"]},"gcp":{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"},"platform":{"type":"string","enum":["gcp"]}},"required":["serviceAccountEmail","platform"]},"azure":{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."},"platform":{"type":"string","enum":["azure"]}},"required":["managingTenantId","oidcIssuer","oidcSubject","platform"]},"kubernetes":{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}},"description":"Per-platform management configurations for cross-account access (self-reported via heartbeat)"},"ManagerStatus":{"type":"string","enum":["healthy","degraded","unhealthy","unknown"],"description":"Current health status"},"ManagerDomainBindingResponse":{"type":"object","properties":{"managerDomainBinding":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["managerDomainBinding"]},"UpdateManagerDomainBinding":{"type":"object","properties":{"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"}},"additionalProperties":false},"UpdateManagerRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Optional release ID to update to. If not provided, the active release will be chosen","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for updating a manager to a new release"},"Event":{"type":"object","properties":{"id":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"debugSessionId":{"type":"string","nullable":true,"pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"data":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["LoadingConfiguration"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["Finished"]}},"required":["type"]},{"type":"object","properties":{"stack":{"type":"string","description":"Name of the stack being built"},"type":{"type":"string","enum":["BuildingStack"]}},"required":["stack","type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform being targeted"},"stack":{"type":"string","description":"Name of the stack being checked"},"type":{"type":"string","enum":["RunningPreflights"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"targetTriple":{"type":"string","description":"Target triple for the runtime"},"type":{"type":"string","enum":["DownloadingAlienRuntime"]},"url":{"type":"string","description":"URL being downloaded from"}},"required":["targetTriple","type","url"]},{"type":"object","properties":{"relatedResources":{"type":"array","items":{"type":"string"},"description":"All resource names sharing this build (for deduped container groups)"},"resourceName":{"type":"string","description":"Name of the resource being built"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["BuildingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being built"},"type":{"type":"string","enum":["BuildingImage"]}},"required":["image","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being pushed"},"progress":{"oneOf":[{"type":"object","properties":{"bytesUploaded":{"type":"integer","minimum":0,"description":"Bytes uploaded so far"},"layersUploaded":{"type":"integer","minimum":0,"description":"Number of layers uploaded so far"},"operation":{"type":"string","description":"Current operation being performed"},"totalBytes":{"type":"integer","minimum":0,"description":"Total bytes to upload"},"totalLayers":{"type":"integer","minimum":0,"description":"Total number of layers to upload"}},"required":["bytesUploaded","layersUploaded","operation","totalBytes","totalLayers"],"description":"Progress information for image push operations"},{"nullable":true}]},"type":{"type":"string","enum":["PushingImage"]}},"required":["image","type"]},{"type":"object","properties":{"destination":{"type":"string","nullable":true,"description":"Human-readable destination for pushed images"},"platform":{"type":"string","description":"Target platform"},"stack":{"type":"string","description":"Name of the stack being pushed"},"type":{"type":"string","enum":["PushingStack"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"resourceName":{"type":"string","description":"Name of the resource being pushed"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["PushingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"project":{"type":"string","description":"Project name"},"type":{"type":"string","enum":["CreatingRelease"]}},"required":["project","type"]},{"type":"object","properties":{"language":{"type":"string","description":"Language being compiled (rust, typescript, etc.)"},"progress":{"type":"string","nullable":true,"description":"Current progress/status line from the build output"},"type":{"type":"string","enum":["CompilingCode"]}},"required":["language","type"]},{"type":"object","properties":{"nextState":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},"suggestedDelayMs":{"type":"integer","nullable":true,"minimum":0,"description":"An suggested duration to wait before executing the next step."},"type":{"type":"string","enum":["StackStep"]}},"required":["nextState","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["GeneratingCloudFormationTemplate"]}},"required":["type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform for which the template is being generated"},"type":{"type":"string","enum":["GeneratingTemplate"]}},"required":["platform","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being provisioned"},"releaseId":{"type":"string","description":"ID of the release being deployed to the agent"},"type":{"type":"string","enum":["ProvisioningAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being updated"},"releaseId":{"type":"string","description":"ID of the new release being deployed to the agent"},"type":{"type":"string","enum":["UpdatingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being deleted"},"releaseId":{"type":"string","description":"ID of the release that was running on the agent"},"type":{"type":"string","enum":["DeletingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being debugged"},"debugSessionId":{"type":"string","description":"ID of the debug session"},"type":{"type":"string","enum":["DebuggingAgent"]}},"required":["agentId","debugSessionId","type"]},{"type":"object","properties":{"strategyName":{"type":"string","description":"Name of the deployment strategy being used"},"type":{"type":"string","enum":["PreparingEnvironment"]}},"required":["strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being deployed"},"type":{"type":"string","enum":["DeployingStack"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being tested"},"type":{"type":"string","enum":["RunningTestWorker"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpStack"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpEnvironment"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"platformName":{"type":"string","description":"Name of the platform (e.g., \"AWS\", \"GCP\")"},"type":{"type":"string","enum":["SettingUpPlatformContext"]}},"required":["platformName","type"]},{"type":"object","properties":{"repositoryName":{"type":"string","description":"Name of the docker repository"},"type":{"type":"string","enum":["EnsuringDockerRepository"]}},"required":["repositoryName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeployingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"roleArn":{"type":"string","description":"ARN of the role to assume"},"type":{"type":"string","enum":["AssumingRole"]}},"required":["roleArn","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"type":{"type":"string","enum":["ImportingStackStateFromCloudFormation"]}},"required":["cfnStackName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeletingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"bucketNames":{"type":"array","items":{"type":"string"},"description":"Names of the S3 buckets being emptied"},"type":{"type":"string","enum":["EmptyingBuckets"]}},"required":["bucketNames","type"]},{"type":"object","properties":{"deploymentGroupId":{"type":"string","description":"ID of the deployment group this slot belongs to"},"deploymentId":{"type":"string","description":"ID of the deployment that was created"},"releaseId":{"type":"string","nullable":true,"description":"Initial release the slot was created with, if any"},"type":{"type":"string","enum":["DeploymentCreated"]}},"required":["deploymentGroupId","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously live, if any"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentReleased"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release the platform was trying to deploy, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"phase":{"type":"string","enum":["preflights","provisioning","updating","deleting"],"description":"Phase of a deployment at which a failure occurred.\n\nDerived from the source deployment status: `preflights-failed` →\n`Preflights`, `provisioning-failed` → `Provisioning`, `update-failed` →\n`Updating`, `delete-failed` → `Deleting`.\n`refresh-failed` is modelled separately via `DeploymentDegraded`."},"type":{"type":"string","enum":["DeploymentFailed"]}},"required":["deploymentId","error","phase","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"type":{"type":"string","enum":["DeploymentDegraded"]}},"required":["deploymentId","error","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentRecovered"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment that was deleted"},"type":{"type":"string","enum":["DeploymentDeleted"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Name of the channel that moved"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously current, if any"},"releaseId":{"type":"string","description":"ID of the release that is now current"},"type":{"type":"string","enum":["ReleaseChannelUpdated"]}},"required":["channel","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Newly followed channel"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousChannel":{"type":"string","description":"Previously followed channel"},"type":{"type":"string","enum":["DeploymentReleaseChannelChanged"]}},"required":["channel","deploymentId","previousChannel","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release that the failed attempt was targeting, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousError":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"type":{"type":"string","enum":["DeploymentRetryRequested"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release being redeployed"},"type":{"type":"string","enum":["DeploymentRedeployRequested"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"pinnedReleaseId":{"type":"string","description":"ID of the release that is now pinned"},"previousPinnedReleaseId":{"type":"string","nullable":true,"description":"ID of the previously pinned release, if any"},"type":{"type":"string","enum":["DeploymentReleasePinned"]}},"required":["deploymentId","pinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousPinnedReleaseId":{"type":"string","description":"ID of the release that was previously pinned"},"type":{"type":"string","enum":["DeploymentReleaseUnpinned"]}},"required":["deploymentId","previousPinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"changedKeys":{"type":"array","items":{"type":"string"},"description":"Names of the environment variables that changed (added, removed, or modified)"},"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentEnvironmentUpdated"]}},"required":["changedKeys","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentDeletionRequested"]}},"required":["deploymentId","type"]},{"$ref":"#/components/schemas/DeploymentCredentialRotationEvent"}]},"state":{"oneOf":[{"type":"object","properties":{"failed":{"type":"object","properties":{"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]}},"description":"Event failed with an error"}},"required":["failed"]},{"type":"string","enum":["none"]},{"type":"string","enum":["started"]},{"type":"string","enum":["success"]}],"description":"Represents the state of an event"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","data","state","projectId","createdAt","workspaceId"]},"DeploymentCredentialRotationEvent":{"type":"object","properties":{"type":{"type":"string","enum":["DeploymentCredentialRotation"]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"rotationId":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"previousKeyId":{"type":"string"},"candidateKeyId":{"type":"string"},"actor":{"type":"object","properties":{"kind":{"type":"string","enum":["user","serviceAccount"]},"id":{"type":"string"}},"required":["kind","id"]}},"required":["type","deploymentId","rotationId","revision","status","previousKeyId","candidateKeyId","actor"]},"GenerateManagerTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string","description":"Platform JWT for authenticating with the manager"},"expiresIn":{"type":"number","nullable":true,"description":"Token lifetime in seconds"},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","description":"Manager URL for direct access"},"databaseId":{"type":"string","nullable":true,"description":"Log database ID (null if logs not configured)"},"controlPlaneUrl":{"type":"string","nullable":true,"description":"Log control plane URL (null if logs not configured)"}},"required":["accessToken","expiresIn","tokenType","managerUrl","databaseId","controlPlaneUrl"]},"GenerateManagerTokenRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to scope token access to."}},"required":["project"]},"GenerateManagerBindingTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string"}},"required":["accessToken","expiresIn","tokenType","managerUrl"]},"GenerateManagerBindingTokenRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"kind":{"type":"string","enum":["data","sandbox"],"description":"Binding kind the token resolves. Defaults to the deployment's own kind: sandbox for a sandbox deployment, data otherwise."}},"required":["deploymentId"],"additionalProperties":false},"ResolveManagerGcpOAuthProviderResponse":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId","clientSecret"]}]},"ResolveManagerGcpOAuthProviderRequest":{"type":"object","properties":{"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group bearer token whose project-level OAuth provider should be resolved."},"returnOrigin":{"type":"string","format":"uri","description":"Browser origin that will receive the Google OAuth callback result. Must be a first-party dashboard origin or the active portal origin for the deployment group's project."}},"required":["deploymentGroupToken"]},"ManagerHeartbeatResponse":{"type":"object","properties":{"acknowledged":{"type":"boolean"},"timestamp":{"type":"string"}},"required":["acknowledged","timestamp"]},"ManagerHeartbeatRequest":{"type":"object","properties":{"status":{"type":"string","enum":["healthy","degraded","unhealthy"],"description":"Current health status"},"version":{"type":"string","description":"Manager version"},"url":{"type":"string","format":"uri","description":"Manager public URL (for accessing DeepStore endpoints)"},"managementConfigs":{"allOf":[{"$ref":"#/components/schemas/ManagerManagementConfigs"},{"description":"Per-platform management configurations for cross-account access"}]},"metrics":{"type":"object","properties":{"activeDeployments":{"type":"number"},"pendingDeployments":{"type":"number"},"memoryUsageMb":{"type":"number"},"cpuUsagePercent":{"type":"number"}},"description":"Optional runtime metrics"}},"required":["status","url","managementConfigs"]},"ManagerDeployment":{"type":"object","properties":{"platform":{"type":"string","description":"Platform of the internal deployment"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status of the internal deployment"},"deploymentId":{"type":"string","description":"Internal deployment ID"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Currently deployed private manager release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Target private manager release for an in-progress update","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"error":{"nullable":true,"description":"Latest provision / upgrade / delete error"},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type"},"status":{"type":"string","description":"Resource status"},"outputs":{"type":"object","additionalProperties":{"nullable":true},"description":"Resource outputs"}},"required":["type","status"]},"description":"Simplified stack state resources"},"environmentInfo":{"nullable":true,"description":"Manager environment info"}},"required":["platform","status","deploymentId","resources"]},"ContainerRegistryManagerSnapshot":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"routes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string"},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"routableUpstreamName":{"type":"string","nullable":true},"remoteResourceRevision":{"type":"string"}},"required":["id","logicalName","desiredState","routableUpstreamName","remoteResourceRevision"],"additionalProperties":false}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"secretPrefix":{"type":"string"},"secretDigest":{"type":"string","pattern":"^[0-9a-f]{64}$"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","secretPrefix","secretDigest","scope","repositorySubset","expiresAt","revokedAt"],"additionalProperties":false}}},"required":["id","deploymentId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","repositories","credentials"],"additionalProperties":false}}},"required":["generatedAt","routes"],"additionalProperties":false},"ApplyContainerRegistrySnapshotResponse":{"type":"object","properties":{"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["applying","connected","degraded","revoked"]}},"required":["appliedRevision","status"],"additionalProperties":false},"PrepareOperatorManifestPackageResponse":{"type":"object","properties":{"package":{"$ref":"#/components/schemas/Package"}},"required":["package"]},"PrepareOperatorManifestPackageRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}},"required":["project"],"additionalProperties":false},"RenderOperatorManifestResponse":{"type":"object","properties":{"manifest":{"type":"string","description":"Rendered multi-document Kubernetes manifest"},"applyCommand":{"type":"string","description":"kubectl command for applying the manifest from a file"},"filename":{"type":"string","description":"Suggested local filename"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the manifest"},"imagePending":{"type":"boolean","description":"True when the operator image is still building. The manifest contains a placeholder image (<PENDING_IMAGE>) and must not be applied yet — re-render once the operator-image package is ready to get the real image."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["manifest","applyCommand","filename","managerUrl","imagePending","operatorImage"]},"RenderOperatorManifestRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"format":{"type":"string","enum":["raw","helm"],"default":"raw","description":"raw: a kubectl-applyable manifest for one cluster. helm: a paste-into-your-chart template whose namespace and environment name come from Helm at install time."},"environmentName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Per-environment identity. Required for raw output, ignored for helm.","example":"my-app"},"namespace":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([-a-z0-9]*[a-z0-9])?$","description":"Namespace to observe and install into. Omit for helm to use the release namespace."},"scope":{"type":"string","enum":["namespace","cluster"],"default":"namespace","description":"namespace: a namespaced Role that manages the install namespace. cluster: a ClusterRole that manages every namespace."},"labelSelector":{"type":"string","minLength":1,"maxLength":256,"description":"Optional Kubernetes label selector narrowing what is managed, applied within the scope."},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to use for the Operator image. If omitted, the latest ready operator-image package for the project is used.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group token embedded in the operator Secret"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","default":false},"podLabelKey":{"type":"string","minLength":1,"description":"Existing Pod label key to collect logs from. Set with podLabelValue."},"podLabelValue":{"type":"string","minLength":1,"description":"Existing Pod label value to collect logs from. Set with podLabelKey."}},"description":"Enable the node log collector DaemonSet for raw pod logs."},"stackSettings":{"$ref":"#/components/schemas/StackSettings"}},"required":["project","deploymentGroupToken"],"additionalProperties":false},"StackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"EcsBootstrapWriteCheckRequest":{"type":"object","properties":{"stackName":{"type":"string","pattern":"^[A-Za-z][A-Za-z0-9-]{0,127}$"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"}},"required":["stackName","accountId","region","clusterArn"],"additionalProperties":false},"RenderOperatorEcsCloudFormationResponse":{"type":"object","properties":{"template":{"type":"string","nullable":true,"description":"CloudFormation JSON for an ECS Fargate service, or null while the immutable Operator image is building. The artifact contains no bootstrap credential values."},"filename":{"type":"string","description":"Suggested local CloudFormation filename"},"stackName":{"type":"string","description":"Suggested stack name for this installation"},"deployCommand":{"type":"string","nullable":true,"description":"Local bash/zsh deploy command, or null while the image is building. Before writing a bootstrap secret, it asks Alien to verify the one-time setup token and registration state, then preserves or generates the encryption key and writes both to customer-owned Secrets Manager. Once an Operator has registered from this stack, it reuses the stored secret at its current version and never asks for a token. It passes only the secret ARN and version ID to CloudFormation."},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the task definition"},"image":{"type":"string","description":"Immutable Operator image reference, or <PENDING_IMAGE>"},"imagePending":{"type":"boolean","description":"True until a ready Operator image digest is available. A pending template must not be deployed."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["template","filename","stackName","deployCommand","managerUrl","image","imagePending","operatorImage"]},"RenderOperatorEcsCloudFormationRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"environmentName":{"type":"string","minLength":2,"maxLength":100,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Stable per-environment Remote Operator installation name"},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"},"subnetIds":{"type":"array","items":{"type":"string","pattern":"^subnet-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact subnet ID for an Operator task ENI"},"minItems":1,"maxItems":16},"securityGroupIds":{"type":"array","items":{"type":"string","pattern":"^sg-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact security group ID for an Operator task ENI"},"minItems":1,"maxItems":16},"assignPublicIp":{"type":"string","enum":["DISABLED","ENABLED"],"default":"DISABLED"},"efsFileSystemId":{"type":"string","pattern":"^fs-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS filesystem ID for the Operator identity. Omit it, with efsAccessPointId, to have the stack create retained EFS storage."},"efsAccessPointId":{"type":"string","pattern":"^fsap-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS access point ID (POSIX UID and GID 1000) on efsFileSystemId. Supply it together with efsFileSystemId."},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to pin in the task definition. If omitted, the current project package is prepared or reused.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"s3BucketArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$","description":"Exact ARN of an S3 bucket the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned S3 ceiling. Required when enabled S3 operations need ListBucket or GetObject; the generated role contains only these bucket and object ARNs."},"sqsQueueArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):sqs:[a-z0-9]+(?:-[a-z0-9]+)+:[0-9]{12}:(?:[A-Za-z0-9_-]{1,80}|[A-Za-z0-9_-]{1,75}\\.fifo)$","description":"Exact ARN of an SQS queue the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned SQS ceiling. Required when enabled SQS operations read queue attributes; the generated role contains only these queue ARNs."}},"required":["project","environmentName","accountId","region","clusterArn","subnetIds","securityGroupIds"],"additionalProperties":false},"APIKey":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"},"createdByUser":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"email":{"type":"string"},"image":{"type":"string","nullable":true}},"required":["id","email","image"],"description":"User information associated with the API key"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig","createdByUser"],"description":"API key information"},"APIKeyDeploymentSetupConfig":{"type":"object","nullable":true,"properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/APIKeyDeploymentSetupEnvironmentVariable"}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8}},"required":["metadata","policy","environmentVariables"]},"APIKeyDeploymentSetupEnvironmentVariable":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]},"CreateAPIKeyResponse":{"type":"object","properties":{"apiKey":{"type":"string","description":"The generated API key value (only shown once)"},"keyInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig"]}},"required":["apiKey","keyInfo"],"description":"Response containing the new API key and its metadata"},"CreateAPIKeyRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"scope":{"$ref":"#/components/schemas/Scope"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"required":["description","scope","expiresAt"],"description":"Request schema for creating a new API key"},"Scope":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceScope"},{"$ref":"#/components/schemas/ProjectScope"},{"$ref":"#/components/schemas/DeploymentScope"},{"$ref":"#/components/schemas/DeploymentGroupScope"},{"$ref":"#/components/schemas/ManagerScope"}],"discriminator":{"propertyName":"type","mapping":{"workspace":"#/components/schemas/WorkspaceScope","project":"#/components/schemas/ProjectScope","deployment":"#/components/schemas/DeploymentScope","deployment-group":"#/components/schemas/DeploymentGroupScope","manager":"#/components/schemas/ManagerScope"}},"description":"Scope and role configuration for service accounts"},"WorkspaceScope":{"type":"object","properties":{"type":{"type":"string","enum":["workspace"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["type","role"],"description":"Workspace-scoped configuration"},"ProjectScope":{"type":"object","properties":{"type":{"type":"string","enum":["project"]},"projectId":{"type":"string","description":"ID of the project this is scoped to"},"role":{"$ref":"#/components/schemas/ProjectRole"}},"required":["type","projectId","role"],"description":"Project-scoped configuration"},"DeploymentScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment"]},"deploymentId":{"type":"string","description":"ID of the deployment this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"},"role":{"$ref":"#/components/schemas/DeploymentRole"}},"required":["type","deploymentId","projectId","role"],"description":"Deployment-scoped configuration"},"DeploymentGroupScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"]},"deploymentGroupId":{"type":"string","description":"ID of the deployment group this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"},"role":{"$ref":"#/components/schemas/DeploymentGroupRole"}},"required":["type","deploymentGroupId","projectId","role"],"description":"Deployment group-scoped configuration"},"ManagerScope":{"type":"object","properties":{"type":{"type":"string","enum":["manager"]},"managerId":{"type":"string","description":"ID of the manager this is scoped to"},"role":{"$ref":"#/components/schemas/ManagerRole"}},"required":["type","managerId","role"],"description":"Manager-scoped configuration"},"UpdateAPIKeyRequest":{"type":"object","properties":{"enabled":{"type":"boolean"},"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"deploymentSetupConfig":{"$ref":"#/components/schemas/UpdateDeploymentSetupPolicy"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"description":"Request schema for updating an API key"},"UpdateDeploymentSetupPolicy":{"type":"object","properties":{"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"}},"required":["policy"],"description":"Editable part of a deployment link's setup config. Locked env vars and input values are preserved."},"DeleteAPIKeysRequest":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"minItems":1}},"required":["ids"]},"DomainWithUsage":{"allOf":[{"$ref":"#/components/schemas/Domain"},{"type":"object","properties":{"endpoints":{"type":"array","items":{"$ref":"#/components/schemas/DomainEndpoint"}},"usage":{"type":"object","properties":{"deploymentUrlProjects":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"portalBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true},"hostname":{"type":"string"}},"required":["id","projectId","projectName","hostname"]}},"packageDomains":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"hostname":{"type":"string"}},"required":["id","hostname"]}},"managerBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"managerId":{"type":"string"},"managerName":{"type":"string"},"hostname":{"type":"string"}},"required":["id","managerId","managerName","hostname"]}}},"required":["deploymentUrlProjects","portalBindings","packageDomains","managerBindings"]}},"required":["endpoints","usage"]}]},"Domain":{"type":"object","properties":{"id":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domain":{"type":"string"},"isSystem":{"type":"boolean"},"claimToken":{"type":"string"},"hostedZoneId":{"type":"string","nullable":true},"nameServers":{"type":"array","nullable":true,"items":{"type":"string"}},"status":{"type":"string","enum":["pending-zone-creation","pending-verification","verified","lost-verification","failed","deleting"]},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verifiedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","workspaceId","domain","isSystem","claimToken","status","createdAt","updatedAt"]},"EventListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Event"},{"type":"object","properties":{"releaseCreatedAt":{"type":"string","format":"date-time","nullable":true,"description":"createdAt of the event's referenced release, included when ?include=releaseCreatedAt is used"}}}]},"IncidentListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Incident"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"],"additionalProperties":false},"Incident":{"type":"object","properties":{"id":{"type":"string"},"number":{"type":"integer","minimum":0,"exclusiveMinimum":true},"reference":{"type":"string"},"title":{"type":"string"},"scopeLabel":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true},"sessionStatus":{"type":"string","nullable":true,"enum":["queued","running","halted","complete","error","canceled",null]},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","number","reference","title","scopeLabel","agentSessionId","sessionStatus","projectId","deploymentId","releaseId","createdAt","updatedAt"],"additionalProperties":false},"IncidentResponse":{"type":"object","properties":{"incident":{"$ref":"#/components/schemas/Incident"}},"required":["incident"],"additionalProperties":false},"ListMachinesJoinTokensResponse":{"type":"object","properties":{"tokens":{"type":"array","items":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"}}},"required":["tokens"]},"MachinesJoinTokenSummary":{"type":"object","properties":{"id":{"type":"string"},"createdAt":{"type":"string"},"createdBy":{"type":"string"},"expiresAt":{"type":"string","nullable":true},"maxJoins":{"type":"integer","nullable":true},"joinCount":{"type":"integer"},"lastUsedAt":{"type":"string","nullable":true},"revokedAt":{"type":"string","nullable":true}},"required":["id","createdAt","createdBy","joinCount"]},"CreateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RotateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RevokeMachinesJoinTokenResponse":{"type":"object","properties":{"tokenId":{"type":"string"},"revoked":{"type":"boolean"}},"required":["tokenId","revoked"]},"CancelMachinesMachineDrainResponse":{"type":"object","properties":{"machineId":{"type":"string"},"cancelled":{"type":"boolean"}},"required":["machineId","cancelled"]},"DrainMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"requested":{"type":"boolean"}},"required":["machineId","requested"]},"DrainMachinesMachineRequest":{"type":"object","properties":{"deadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"force":{"type":"boolean"}}},"RemoveMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"removed":{"type":"boolean"}},"required":["machineId","removed"]},"CommandBootstrapResponse":{"type":"object","properties":{"managerUrl":{"type":"string","format":"uri","description":"Current customer-facing manager URL"},"token":{"type":"string","minLength":1,"description":"Short-lived command capability token"},"expiresAt":{"type":"string","format":"date-time","description":"Capability expiry in RFC 3339 format"},"target":{"$ref":"#/components/schemas/CommandReceiverBootstrapTarget"}},"required":["managerUrl","token","expiresAt"]},"CommandReceiverBootstrapTarget":{"type":"object","properties":{"resourceId":{"type":"string"},"resourceType":{"type":"string","enum":["container","daemon"]}},"required":["resourceId","resourceType"],"description":"Resolved target identity; present only for receiver bootstrap"},"CommandBootstrapRequest":{"oneOf":[{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["sender"]}},"required":["deploymentId","role"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["receiver"]},"target":{"type":"string","minLength":1,"maxLength":255}},"required":["deploymentId","role","target"],"additionalProperties":false}]},"CommandListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Command"},{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/CommandDeploymentInfo"},"project":{"$ref":"#/components/schemas/CommandProjectInfo"}}}]},"CommandVerification":{"type":"object","nullable":true,"properties":{"state":{"type":"string","enum":["not-required","pending","verified","failed","skipped"],"description":"Verification outcome of an operation command."},"reason":{"type":"string","nullable":true,"description":"Present for 'failed' and 'skipped'."}},"required":["state","reason"],"description":"Verification outcome of an operation command; null for commands that are not operations"},"CommandDeploymentInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/CommandDeploymentGroupInfo"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"managerId":{"type":"string","description":"Manager ID for obtaining access tokens"},"managerUrl":{"type":"string","nullable":true,"format":"uri","description":"URL of the manager for direct payload access"},"managerName":{"type":"string","nullable":true,"description":"Human-readable name of the manager"},"managerIsSystem":{"type":"boolean","nullable":true,"description":"Whether the manager is Alien-hosted (system)"}},"required":["id","name","managerId"]},"CommandDeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"CommandProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string"}},"required":["id","name"]},"Command":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","description":"Command name (e.g., 'analyze-repository', 'sync-data')"},"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Command states in the Commands protocol lifecycle"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Delivery mode for this command (push/pull), derived from the target at creation time"},"target":{"type":"object","nullable":true,"properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to; null on commands created before target routing"},"attempt":{"type":"number","nullable":true,"description":"Current attempt number"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","nullable":true,"description":"Size of command params in bytes"},"responseSizeBytes":{"type":"number","nullable":true,"description":"Size of command response in bytes"},"createdAt":{"type":"string","format":"date-time","description":"When the command was created"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command was dispatched to the deployment"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command completed"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if command failed"},"accessRequestId":{"type":"string","nullable":true,"description":"The approved access request that authorized this operation command, if one did"},"verification":{"$ref":"#/components/schemas/CommandVerification"},"result":{"nullable":true,"description":"Decoded command result when available"},"resultAvailability":{"type":"string","enum":["available","protected"],"description":"Whether a successful operation result is included or withheld pending explicit confirmation"}},"required":["id","deploymentId","projectId","workspaceId","name","state","deploymentModel","target","attempt","deadline","requestSizeBytes","responseSizeBytes","createdAt","dispatchedAt","completedAt","error","accessRequestId","verification"]},"ListCommandNamesResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}}},"required":["names"]},"ListCommandDeploymentsResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"required":["id","name"]}}},"required":["deployments"]},"CreateCommandResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"projectId":{"type":"string","description":"Project ID (for manager to use in routing)"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"How to dispatch the command"},"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to"},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How the command is delivered to its target"},"operationResultContractPersisted":{"type":"boolean","description":"Whether an operation result contract was stored atomically with this command"}},"required":["id","projectId","deploymentModel","target","deliveryMode","operationResultContractPersisted"]},"CreateCommandRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Target deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":1,"maxLength":255,"description":"Command name (e.g., 'analyze-repository')"},"params":{"nullable":true,"description":"Command parameters for public invocation"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key for public invocation retries. Requires params; use null for a command without arguments. Reuse the same key and identical request to recover the original command for up to 24 hours. Scoped to the workspace, caller, deployment, resolved target, and command name. The first accepted request wins; changed params or deadlines do not create a new command with the same key. Omit for a new invocation without retry protection."},"target":{"type":"string","maxLength":255,"description":"Resource id the command is addressed to. Required when the deployment has more than one command-capable resource."},"initialState":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Initial state (PENDING_UPLOAD if params require upload, PENDING if inline)"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Size of command params in bytes"},"operationResultContract":{"nullable":true,"description":"Opaque operation result contract with an optional accessRequestId binding, forwarded by a manager and persisted atomically before dispatch"}},"required":["deploymentId","name"]},"ResolvedCommandTarget":{"type":"object","properties":{"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Identifies the specific resource a command is addressed to."},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How a command is delivered to its target resource.\n\nThis is a Commands-protocol-specific concept and is intentionally distinct\nfrom `DeploymentModel` (see `stack_settings.rs`), which governs the\ninfrastructure-level push/pull wiring for a deployment. Serialized\nlowercase for consistency with `CommandTargetType`."}},"required":["target","deliveryMode"]},"UpdateCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"New command state"},"attempt":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Current attempt number"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command was dispatched"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}}},"DispatchCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"DispatchCommandRequest":{"type":"object","properties":{"dispatchedAt":{"type":"string","format":"date-time","description":"When the command was dispatched"}},"required":["dispatchedAt"]},"CompleteCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"CompleteCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["SUCCEEDED","FAILED","EXPIRED"],"description":"Terminal state to transition to"},"completedAt":{"type":"string","format":"date-time","description":"When the command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}},"required":["state","completedAt"]},"IncrementCommandAttemptResponse":{"type":"object","properties":{"attempt":{"type":"integer","description":"The attempt number after the increment"}},"required":["attempt"]},"DebugSessionListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DebugSession"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"},"DebugSession":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"owner":{"type":"string","nullable":true,"maxLength":128},"state":{"$ref":"#/components/schemas/DebugSessionState"},"mode":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"provider":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Represents the target cloud platform."},"presignedUrls":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DebugPackagePresignedURLs"}},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","state","mode","presignedUrls","createdAt","expiresAt","deploymentId","projectId","workspaceId"]},"DebugSessionState":{"type":"string","enum":["pending","running","stopping","stopped","expired","failed"]},"DebugPackagePresignedURLs":{"type":"object","properties":{"readUrl":{"type":"string","maxLength":2048,"format":"uri"},"writeUrl":{"type":"string","maxLength":2048,"format":"uri"}},"required":["readUrl","writeUrl"]},"CreateDebugSessionRequest":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Override the generated id. Manager passes the registry session id so logs correlate.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"owner":{"type":"string","nullable":true,"maxLength":128},"expiresAt":{"type":"string","format":"date-time"},"state":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Initial state. Defaults to 'pending'."}]},"accessRequestId":{"type":"string","description":"The caller's own access request whose debug grant authorized this session, for the same deployment."}},"required":["deploymentId","expiresAt"]},"UpdateDebugSessionRequest":{"type":"object","properties":{"state":{"$ref":"#/components/schemas/DebugSessionState"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"expiresAt":{"type":"string","format":"date-time"}}},"DeploymentInfo":{"type":"object","properties":{"setupUpdate":{"type":"object","properties":{"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"releaseId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"}],"nullable":true},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"}],"nullable":true},"setupTarget":{"type":"string","nullable":true},"resourcePrefix":{"type":"string","nullable":true},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["deploymentId","updateOperationId","releaseId","name","platform","setupMethod","setupMetadata","setupTarget","resourcePrefix","stackSettings"]},"tokenType":{"type":"string","enum":["deployment","deployment-group"],"description":"Type of token used to authenticate this request"},"deployment":{"type":"object","properties":{"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["name","platform"],"description":"Deployment details (present when using a deployment-scoped token)"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"pinnedSubdomain":{"type":"string","nullable":true}},"required":["id","name","pinnedSubdomain"],"description":"Deployment group details (present when using a deployment-group token)"},"workspace":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"avatarUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name"]},"project":{"type":"object","properties":{"name":{"type":"string"},"portal":{"type":"object","properties":{"appearance":{"$ref":"#/components/schemas/DeploymentPortalAppearance"}},"required":["appearance"]},"stackSummary":{"type":"object","nullable":true,"properties":{"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms supported by the active release"},"requiresNetwork":{"type":"boolean","description":"Whether the stack contains resources that require cloud VPC networking"},"customerModels":{"type":"boolean","description":"Whether this release offers one remotely accessible AI resource"},"resourceCounts":{"type":"object","properties":{"workers":{"type":"integer","minimum":0},"containers":{"type":"integer","minimum":0},"daemons":{"type":"integer","minimum":0,"description":"Daemon resources that run on managed runtime machines"},"publicHttpsEndpoints":{"type":"integer","minimum":0,"description":"Resources that declare managed public HTTPS endpoint setup"},"externalInfra":{"type":"integer","minimum":0,"description":"Storage, queue, KV, vault, database, or cache resources that Kubernetes needs Terraform to provision"},"total":{"type":"integer","minimum":0}},"required":["workers","containers","publicHttpsEndpoints","externalInfra","total"]},"publicEndpoints":{"type":"array","items":{"type":"object","properties":{"resourceId":{"type":"string"},"endpointName":{"type":"string"},"hostLabel":{"type":"string"},"wildcardSubdomains":{"type":"boolean"}},"required":["resourceId","endpointName","hostLabel","wildcardSubdomains"]},"description":"Public endpoints declared by the active release stack"}},"required":["platforms","requiresNetwork","customerModels","resourceCounts","publicEndpoints"]},"generatedDomain":{"type":"object","nullable":true,"properties":{"domain":{"type":"string"},"isSystem":{"type":"boolean"}},"required":["domain","isSystem"],"description":"Parent domain for generated deployment URLs. Chosen public subdomains are only allowed when isSystem is false."}},"required":["name","portal"]},"packages":{"type":"object","properties":{"ready":{"type":"boolean","description":"True if all enabled packages are ready for deployment"},"cli":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"commandName":{"type":"string","description":"CLI command name to use in install instructions"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},"error":{"nullable":true},"installScripts":{"type":"object","properties":{"windows":{"type":"string","format":"uri"},"mac":{"type":"string","format":"uri"},"linux":{"type":"string","format":"uri"}},"required":["windows","mac","linux"],"description":"Install script URLs for each OS"}},"required":["status","commandName","installScripts"]},"cloudformation":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},"error":{"nullable":true},"mode":{"type":"string","enum":["auto","outputs"]},"launchUrl":{"type":"string","format":"uri","description":"CloudFormation launch URL"},"outputsSchema":{"nullable":true}},"required":["status","mode","launchUrl"]},"terraform":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},"error":{"nullable":true},"providerSource":{"type":"string","description":"Terraform provider source (without https://)"},"moduleSources":{"type":"object","additionalProperties":{"type":"string"},"description":"Terraform module sources by target"},"moduleVersion":{"type":"string"},"managerUrls":{"type":"object","additionalProperties":{"type":"string"},"description":"Manager URLs by Terraform target"}},"required":["status","providerSource","moduleSources","managerUrls"]},"helm":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},"error":{"nullable":true},"chartRef":{"type":"string","description":"OCI chart reference"},"managerUrlOverride":{"type":"string","format":"uri","description":"Management endpoint to supply only when this chart's captured default differs from current installation routing."},"managerFetchExample":{"type":"string"},"localImportExample":{"type":"string"}},"required":["status","chartRef"]}},"required":["ready"]},"installContext":{"type":"object","properties":{"targets":{"type":"object","additionalProperties":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managerUrl":{"type":"string","format":"uri"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"awsManagingAccountId":{"type":"string"}},"required":["platform","managerUrl"]},"description":"Deployment-session install context by Terraform/installer target"}},"required":["targets"]},"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"},"modelAvailabilitySources":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"status":{"type":"string","enum":["current","stale","invalid"]},"availability":{"$ref":"#/components/schemas/AiAvailabilityObservation"}},"required":["deploymentId","resourceId","observedAt","status"]}},"setupItems":{"type":"array","items":{"$ref":"#/components/schemas/SetupItemStatus"}},"setupConfig":{"$ref":"#/components/schemas/DeploymentInfoSetupConfig"},"readiness":{"type":"object","properties":{"status":{"type":"string","enum":["ready","notReady","unknown"]},"checks":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"status":{"type":"string","enum":["passed","failed","warning","unknown"]},"message":{"type":"string"},"checkedAt":{"type":"string"}},"required":["code","status","message","checkedAt"]}}},"required":["status","checks"]}},"required":["tokenType","workspace","project","packages","installContext","supportedRegions","modelAvailabilitySources"]},"DeploymentPortalAppearance":{"type":"object","properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}}},"SupportedCloudRegions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by this Alien environment."},"gcp":{"type":"array","items":{"type":"string"},"description":"GCP regions supported by this Alien environment."},"azure":{"type":"array","items":{"type":"string"},"description":"Azure locations supported by this Alien environment."}},"required":["aws","gcp","azure"]},"AiAvailabilityObservation":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"SetupItemStatus":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false},"status":{"type":"string","enum":["not-started","waiting","applying","verifying","connected","needs-attention","revoked"]},"deploymentIds":{"type":"array","items":{"type":"string"}},"blocker":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]}},"required":["item","source","required","status","deploymentIds"],"additionalProperties":false},"DeploymentInfoSetupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"inputValues":{"type":"array","items":{"$ref":"#/components/schemas/ResolvedStackInputSummary"}}},"required":["metadata","policy","environmentVariables"]},"ResolvedStackInputSummary":{"type":"object","properties":{"id":{"type":"string"},"label":{"type":"string"},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"]}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"provided":{"type":"boolean"}},"required":["id","label","providedBy","required","secret","provided"]},"DeploymentComputePlan":{"type":"object","properties":{"pools":{"type":"array","items":{"type":"object","properties":{"poolId":{"type":"string"},"workloads":{"type":"array","items":{"type":"string"}},"requirements":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"scale":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["fixed"]},"machines":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","machines"]},{"type":"object","properties":{"type":{"type":"string","enum":["autoscale"]},"min":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]},"max":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","min","max"]}]},"selected":{"$ref":"#/components/schemas/ComputePoolSelection"},"recommended":{"$ref":"#/components/schemas/ComputePoolSelection"},"machines":{"type":"array","items":{"type":"object","properties":{"machine":{"type":"string"},"profile":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"recommended":{"type":"boolean"}},"required":["machine","profile","recommended"]}},"errors":{"type":"array","items":{"type":"string"}}},"required":["poolId","workloads","requirements","scale","selected","recommended","machines"]}}},"required":["pools"]},"ComputePoolSelection":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"PreparedDeploymentStack":{"type":"object","properties":{"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"setup":{"$ref":"#/components/schemas/SetupFingerprintInfo"}},"required":["platform","stack","setup"]},"SlackInstallUrlResponse":{"type":"object","properties":{"url":{"type":"string","format":"uri"}},"required":["url"]},"SlackIntegrationStatus":{"type":"object","properties":{"connected":{"type":"boolean"},"slackTeamId":{"type":"string","nullable":true},"slackTeamName":{"type":"string","nullable":true},"installedByUserId":{"type":"string","nullable":true},"installedAt":{"type":"string","nullable":true},"notificationChannelId":{"type":"string","nullable":true}},"required":["connected","slackTeamId","slackTeamName","installedByUserId","installedAt","notificationChannelId"]},"SlackChannelsResponse":{"type":"object","properties":{"channels":{"type":"array","items":{"$ref":"#/components/schemas/SlackChannel"}}},"required":["channels"]},"SlackChannel":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"isMember":{"type":"boolean"}},"required":["id","name","isMember"]},"SlackNotificationChannelResponse":{"type":"object","properties":{"notificationChannelId":{"type":"string","nullable":true},"warning":{"type":"string","nullable":true}},"required":["notificationChannelId","warning"]},"SlackNotificationChannelRequest":{"type":"object","properties":{"channelId":{"type":"string","nullable":true}},"required":["channelId"]},"AgentSessionListResponse":{"type":"object","properties":{"sessions":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionListItem"}}},"required":["sessions"]},"AgentSessionListItem":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"subjectId":{"type":"string"},"subject":{"$ref":"#/components/schemas/AgentSessionSubject"},"status":{"type":"string"},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","triggerType","subjectId","subject","status","createdAt","updatedAt"]},"AgentSessionSubject":{"type":"object","properties":{"deploymentName":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"releaseCommitMessage":{"type":"string","nullable":true},"releaseCommitRef":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true}},"required":["deploymentName","deploymentGroupId","deploymentGroupName","releaseId","releaseCommitMessage","releaseCommitRef","projectId","projectName"]},"AgentSessionDetail":{"allOf":[{"$ref":"#/components/schemas/AgentSessionListItem"},{"type":"object","properties":{"resultText":{"type":"string","nullable":true},"toolNames":{"type":"array","nullable":true,"items":{"type":"string"}},"error":{"type":"string","nullable":true}},"required":["resultText","toolNames","error"]}]},"AgentSessionEventsResponse":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionEvent"}},"latestSeq":{"type":"number"},"hasMore":{"type":"boolean"}},"required":["events","latestSeq","hasMore"]},"AgentSessionEvent":{"oneOf":[{"$ref":"#/components/schemas/AgentSessionStatusEvent"},{"$ref":"#/components/schemas/AgentSessionStepEvent"},{"$ref":"#/components/schemas/AgentSessionToolCallEvent"},{"$ref":"#/components/schemas/AgentSessionToolResultEvent"},{"$ref":"#/components/schemas/AgentSessionMarkdownEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalRequestedEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalGrantedEvent"},{"$ref":"#/components/schemas/AgentSessionRestartedEvent"},{"$ref":"#/components/schemas/AgentSessionEventsTruncatedEvent"}],"discriminator":{"propertyName":"type","mapping":{"status":"#/components/schemas/AgentSessionStatusEvent","step":"#/components/schemas/AgentSessionStepEvent","tool_call":"#/components/schemas/AgentSessionToolCallEvent","tool_result":"#/components/schemas/AgentSessionToolResultEvent","markdown":"#/components/schemas/AgentSessionMarkdownEvent","approval_requested":"#/components/schemas/AgentSessionApprovalRequestedEvent","approval_granted":"#/components/schemas/AgentSessionApprovalGrantedEvent","session_restarted":"#/components/schemas/AgentSessionRestartedEvent","events_truncated":"#/components/schemas/AgentSessionEventsTruncatedEvent"}}},"AgentSessionStatusEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["status"]},"payload":{"type":"object","properties":{"status":{"type":"string"},"error":{"type":"string"}},"required":["status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStepEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["step"]},"payload":{"type":"object","properties":{"stepId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["in_progress","complete","error"]}},"required":["stepId","title","status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolCallEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolResultEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_result"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string","nullable":true},"toolName":{"type":"string","nullable":true},"ok":{"type":"boolean"},"output":{"nullable":true}},"required":["toolCallId","toolName","ok"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionMarkdownEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["markdown"]},"payload":{"type":"object","properties":{"text":{"type":"string"}},"required":["text"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalRequestedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_requested"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["approvalId","toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalGrantedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_granted"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"approvedByUserId":{"type":"string"},"approvedByName":{"type":"string","nullable":true},"source":{"type":"string","enum":["dashboard","slack"]}},"required":["approvalId","approvedByUserId","approvedByName","source"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionRestartedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["session_restarted"]},"payload":{"type":"object","properties":{"reason":{"type":"string"}},"required":["reason"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionEventsTruncatedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["events_truncated"]},"payload":{"type":"object","properties":{"limit":{"type":"number"}},"required":["limit"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStopResponse":{"type":"object","properties":{"jobId":{"type":"string"},"status":{"type":"string"},"canceled":{"type":"boolean"}},"required":["jobId","status","canceled"]},"ListOperationsPluginsResponse":{"type":"object","properties":{"plugins":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPlugin"}},"installations":{"$ref":"#/components/schemas/OperatorInstallationsRollup"}},"required":["plugins","installations"]},"OperationsPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default tier."},"builtin":{"type":"boolean","description":"True for compiled-in plugins, false for custom bundles."},"enabled":{"type":"boolean"},"operations":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPluginOperation"}}},"required":["name","version","tier","builtin","enabled","operations"]},"OperationsPluginOperation":{"type":"object","properties":{"name":{"type":"string","description":"Operation name, unique within the plugin."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier for this operation."},"description":{"type":"string","nullable":true,"description":"Human-readable description."},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for operation parameters when the plugin publishes one."},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for a successful result when the plugin publishes one."},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string"},"pollOperation":{"type":"string"},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string"}},"successField":{"type":"string"},"successValue":{"type":"string"},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"timeoutSeconds":{"type":"integer","minimum":1}},"required":["changes","pollOperation","pollParamsFromResult","successField","successValue","timeoutSeconds"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"requiredPermissions":{"type":"array","items":{"type":"string"},"description":"IDs of permission sets (see alien-permissions) this operation requires. Empty when the operation declares none."},"permissions":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetesPermissions":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["name","tier","description","inputSchema","outputSchema","timeoutSeconds","retries","verification","sensitiveOutput","requiredPermissions","permissions"]},"OperatorInstallationsRollup":{"type":"object","properties":{"total":{"type":"integer","minimum":0,"description":"Total pull-mode installations tracked."},"ready":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["total","ready","syncing","stuck"],"description":"Rollup of this project's pull-mode installations by operations-bundle sync status, reflecting the currently enabled plugin set."},"SetBuiltinOperationsPluginsResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["names","permissionDiff"]},"OperationsPermissionDiff":{"type":"object","properties":{"aws":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change adds."},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change removes from the generated cloud configuration."}},"required":["added","removed"]},"gcp":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}}},"required":["added","removed"]},"kubernetes":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}}},"required":["added","removed"]},"incompleteForPlugins":{"type":"array","items":{"type":"string"},"description":"Previously enabled plugins whose grants could not be read before this change disabled or replaced them. Added and removed grants may be incomplete; inspect existing cloud policies before applying the regenerated configuration."}},"required":["aws","gcp","kubernetes"],"description":"Cloud permission delta versus the previously enabled set."},"OperationsAwsPermissionDiffStatement":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["effect","actions","resources","condition","sources"]},"OperationsPermissionDiffSource":{"type":"object","properties":{"plugin":{"type":"string","description":"Plugin that declared the permission."},"operation":{"type":"string","description":"Operation that declared the permission."},"reason":{"type":"string","description":"Why the operation needs this permission."}},"required":["plugin","operation","reason"]},"OperationsGcpPermissionDiffGrant":{"type":"object","properties":{"permission":{"type":"string"},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"],"description":"Where setup grants the permission: the configured project, or each Cloud Storage bucket the installer lists."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["permission","scope","sources"]},"OperationsKubernetesPermissionDiffGrant":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Empty means every resource name."},"remediationOnly":{"type":"boolean","description":"True for write verbs. The Helm chart renders them only when Operator permission is set to remediation; diagnostics installs omit them."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["apiGroup","resource","verbs","resourceNames","remediationOnly","sources"]},"SetBuiltinOperationsPluginsRequest":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"},"description":"Complete set of built-in plugins to enable."}},"required":["names"],"additionalProperties":false},"OperationsBundleUploadUrlResponse":{"type":"object","properties":{"uploadUrl":{"type":"string","format":"uri","description":"Presigned S3 PUT URL to upload the bundle ZIP to."},"uploadId":{"type":"string","description":"One-time id for this upload. Pass it back verbatim to POST /plugins so the API can validate and snapshot exactly the bytes this call uploaded."},"contentType":{"type":"string","description":"Content-Type header the PUT must send (must match the signature)."}},"required":["uploadUrl","uploadId","contentType"]},"OperationsBundleUploadUrlRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."}},"required":["name"]},"PublishOperationsPluginResponse":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","version","tier","enabled","permissionDiff"]},"PublishOperationsPluginRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."},"version":{"type":"string","minLength":1,"description":"Plugin version."},"uploadId":{"type":"string","minLength":1,"description":"The uploadId returned by POST /plugins/upload-url for the ZIP just uploaded. Identifies the exact S3 object to publish — never derived from name/version, so it can't collide with any other upload."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default risk tier."},"metadata":{"type":"object","properties":{"name":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"default":"destructive"},"binaries":{"oneOf":[{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["amd64"],"additionalProperties":false},{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["arm64"],"additionalProperties":false}]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"description":{"type":"string","nullable":true,"minLength":1},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"paramsSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"permissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"requiredPermissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1,"maximum":4294967295},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string","minLength":1,"description":"Human-readable: what this operation changes."},"pollOperation":{"type":"string","minLength":1,"description":"A read-only operation in the same plugin to poll for success."},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string","minLength":1},"default":{},"description":"Poll operation param name -> field name in the write operation's own result."},"successField":{"type":"string","minLength":1,"description":"Dotted field path in the poll result that signals success."},"successValue":{"type":"string","minLength":1,"description":"The value at successField that means verified."},"retry":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"timeoutSeconds":{"type":"integer","minimum":1,"maximum":4294967295}},"required":["changes","pollOperation","successField","successValue","timeoutSeconds"],"additionalProperties":false},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string","minLength":1},"minItems":1}},"required":["kind","fields"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"],"additionalProperties":false}]},"kubernetesPermissions":{"$ref":"#/components/schemas/KubernetesPermissions"}},"required":["name","permissions"],"additionalProperties":false},"default":[]}},"required":["name","version","binaries"],"additionalProperties":false,"description":"The complete canonical metadata.json from the uploaded bundle."}},"required":["name","version","uploadId","tier","metadata"]},"KubernetesPermissions":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/Rule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false},"Rule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/Verb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"Verb":{"type":"string","enum":["get","list","watch","delete","patch"]},"SetOperationsPluginEnabledResponse":{"type":"object","properties":{"name":{"type":"string"},"builtin":{"type":"boolean"},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","builtin","enabled","permissionDiff"]},"SetOperationsPluginEnabledRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether the plugin is distributed to this project's Operators."},"dryRun":{"type":"boolean","description":"Validate the change and return its permission delta without saving it. Defaults to false."},"expectedPermissionDiff":{"allOf":[{"$ref":"#/components/schemas/OperationsPermissionDiff"},{"description":"The permission delta the caller reviewed, usually from a dry run. When set, the change is rejected with 409 if the current delta differs."}]}},"required":["enabled"]},"OperationsPolicyResponse":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"}},"default":{"type":"string","enum":["auto","manual"],"description":"Decision for commands no rule matches."}},"required":["rules","default"]},"OperationsPolicyRule":{"type":"object","properties":{"pattern":{"type":"string","description":"`plugin/operation`, `plugin/*`, or `*`."},"decision":{"type":"string","enum":["auto","manual"],"description":"auto: run immediately. manual: needs customer approval before running."},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself."}},"required":["pattern","decision"]},"UpdateOperationsPolicyRequest":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"},"description":"The full rule set (replaces the previous one)."}},"required":["rules"]},"InvokeOperationResponse":{"type":"object","properties":{"plugin":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"The operation's declared risk tier (informational)."},"decision":{"type":"string","enum":["auto","manual"],"description":"The approval decision the policy resolved to."},"status":{"type":"string","enum":["dispatched","pending-approval"],"description":"dispatched: auto-approved and running. pending-approval: needs customer sign-off."},"commandId":{"type":"string","description":"The created operation-command id when dispatched (absent when pending)."}},"required":["plugin","operation","tier","decision","status"]},"InvokeOperationRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment to run the operation against."},"plugin":{"type":"string","description":"Plugin name."},"operation":{"type":"string","description":"Operation name exposed by the plugin."},"params":{"nullable":true,"description":"JSON params passed to the operation."},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key used to deduplicate this exact target operation."},"remediationPlanId":{"type":"string","description":"A remediation plan (`plan_…`) whose access request the customer has already approved for this exact command. When set and the plan's access request was created by the caller, is `customer-approved` and lists this `plugin/operation` with these params, the invocation is authorized by that approval and dispatches immediately regardless of the project's operations policy — the customer already signed off on this exact command via the access-request flow, so the project's default `manual` policy (meant for ad-hoc, unreviewed invocations) would otherwise require a second, redundant approval for the same action. Another principal's approved request never authorizes the caller."},"accessRequestId":{"type":"string","description":"A CLI-originated access request (`accessRequest_…`, no remediation plan) the caller created and the customer has already approved covering this exact command — either an exact match or a resolved, frozen wildcard entry. Same bypass semantics as `remediationPlanId`, for requests with no investigation behind them. Set exactly one of `remediationPlanId` or `accessRequestId`, not both. With neither, any approved request the caller created covering this exact command is used."}},"required":["deploymentId","plugin","operation"]},"VerifyOperationCheckResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["verified","not-yet","failed","skipped"],"description":"verified: success condition met. not-yet: keep polling. failed: the poll operation itself reported failure. skipped: the operation has no verification spec, or the write result carries none of the fields verification needs (the caller never opted in for this invocation)."},"reason":{"type":"string","description":"Present for 'failed' and 'skipped'."},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer"},"intervalSeconds":{"type":"integer"}},"required":["maxAttempts","intervalSeconds"],"description":"The operation's declared retry policy, echoed so the caller's poll loop doesn't need its own copy."},"timeoutSeconds":{"type":"integer","description":"The operation's declared verification timeout."}},"required":["outcome"]},"VerifyOperationCheckRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment the original write command ran against."},"commandId":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Original operation command whose stored result and dispatch-time verification contract are authoritative.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"}},"required":["deploymentId","commandId"]},"AccessRequestDebugGrant":{"type":"object","nullable":true,"properties":{"tool":{"$ref":"#/components/schemas/DebugGrantTool"},"namespace":{"type":"string","example":"braintrust"},"cloudScope":{"type":"string","example":"123456789012/prod-readonly"}},"required":["tool"]},"DebugGrantTool":{"type":"string","enum":["kubectl","aws","gcloud","az"]},"AccessRequestStatus":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"CreateAccessRequest":{"type":"object","properties":{"replayKey":{"type":"string","minLength":1,"maxLength":128,"description":"Durable replay key scoped to the authenticated requester and workspace. Reusing it with a different validated payload returns ACCESS_REQUEST_REPLAY_MISMATCH."},"requestedExpiresAt":{"type":"string","format":"date-time","description":"Absolute requester deadline in UTC (Z suffix). Must be in the future and at most six hours ahead (30 seconds clock-skew tolerance). Approvals never extend it. Omit for legacy approval-window behavior."},"deploymentId":{"type":"string"},"remediationPlanId":{"type":"string","description":"Set for a plan-backed (ai-agent) request. Omit for a plan-less (CLI) request."},"title":{"type":"string","description":"Required for a plan-backed request; defaults to the operation/pattern/debug-tool for a plan-less one."},"reason":{"type":"string"},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]},"minItems":1,"description":"Plan-backed only: the exact commands the investigation is requesting."},"operation":{"type":"string","example":"kubernetes/restart-pod","description":"Plan-less, exact request: a single `plugin/operation`."},"operationPattern":{"type":"string","example":"kubernetes/*","description":"Plan-less, wildcard request: `plugin/*`. Requires `maxRisk`."},"params":{"nullable":true,"description":"Params for an exact `operation` request."},"maxRisk":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Required with `operationPattern`: the highest risk tier the wildcard grant may cover."},"debugTool":{"allOf":[{"$ref":"#/components/schemas/DebugGrantTool"},{"description":"Requests a remote-debugging grant for this tool, alongside or instead of an operations grant."}]},"debugNamespace":{"type":"string","example":"braintrust","description":"Scopes a `kubectl` debug grant to one Kubernetes namespace. Requires `debugTool: kubectl`."},"debugCloudScope":{"type":"string","example":"123456789012/prod-readonly","description":"Scopes an `aws`/`gcloud`/`az` debug grant to a customer-meaningful account/project/subscription string. Requires `debugTool` set to that provider."}},"required":["deploymentId"]},"AccessRequestApprovalMethod":{"type":"string","example":"slack"},"AccessRequestActivity":{"type":"object","properties":{"operations":{"type":"array","items":{"type":"object","properties":{"commandId":{"type":"string"},"invocationId":{"type":"string","nullable":true,"description":"The MCP invocation that dispatched the command, when MCP did."},"command":{"type":"string","description":"`plugin/operation`."},"state":{"type":"string"},"createdAt":{"type":"string"},"dispatchedAt":{"type":"string","nullable":true},"completedAt":{"type":"string","nullable":true},"verification":{"$ref":"#/components/schemas/CommandVerification"}},"required":["commandId","invocationId","command","state","createdAt","dispatchedAt","completedAt","verification"]}},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"state":{"$ref":"#/components/schemas/DebugSessionState"},"owner":{"type":"string","nullable":true},"createdAt":{"type":"string"},"expiresAt":{"type":"string"}},"required":["id","state","owner","createdAt","expiresAt"]}}},"required":["operations","debugSessions"]},"RevokeAccessRequest":{"type":"object","properties":{"reason":{"type":"string","maxLength":4096,"description":"Why the grant is withdrawn, for the audit trail."}}},"SyncListResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"userEnvironmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"deploymentToken":{"type":"string","nullable":true},"lockedBy":{"type":"string","nullable":true},"lockedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId","userEnvironmentVariables"]}}},"required":["deployments"],"description":"Full deployment records for manager operation"},"SyncListRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. Manager-scoped tokens are always constrained to their own manager ID."}]},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to include"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment status"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by deployment platform"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Filter by deployment group ID","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"limit":{"type":"integer","minimum":1,"maximum":500,"description":"Maximum records to return"}},"additionalProperties":false,"description":"Request to list full operational deployments"},"SyncAcquireResponseDeployment":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Deployment group ID the deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method recorded on the deployment when it has a setup-owned path."}]},"operationId":{"type":"string","nullable":true,"pattern":"duop_[0-9a-z]{28}$","description":"Immutable target claimed for this execution, or null for observation-only work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","nullable":true,"pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed by this manager session, or null for observation-only work.","example":"duat_uve04tou5eoua3q17dar1pz"},"current":{"$ref":"#/components/schemas/DeploymentState"},"config":{"$ref":"#/components/schemas/DeploymentConfig"}},"required":["deploymentId","projectId","deploymentGroupId","operationId","attemptId","current","config"]},"DeploymentState":{"type":"object","properties":{"currentRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}]},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"protocolVersion":{"type":"integer","minimum":0,"description":"Protocol version for cross-actor compatibility.\nAll actors (manager, push client, agent) check this before stepping.\nMismatched versions produce a clear error instead of silent corruption.\nSee docs/02-manager/10-deployment-protocol.md."},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment\nWhen true and status is a failed state, the deployment system will retry failed resources"},"runtimeMetadata":{"oneOf":[{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},{"nullable":true}]},"stackState":{"oneOf":[{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},{"nullable":true}]},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"targetRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]}},"required":["platform","protocolVersion","status"],"description":"Current deployment state (includes releases)"},"DeploymentConfig":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["environmentVariables"],"description":"Deployment configuration"},"SyncContextRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the context. Manager-scoped tokens are constrained to their own manager ID."}]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false},"SyncAcquireResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"},"description":"List of acquired deployments with deployment context"},"failures":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment that failed","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"error":{"allOf":[{"$ref":"#/components/schemas/APIError"},{"description":"Error that occurred during context building"}]}},"required":["deploymentId","projectId","error"]},"description":"List of deployments that failed during context building (locks already released)"},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time","description":"When the provisional leases on the returned deployments lapse. Confirm them with sync/renew before starting work. Null when nothing was acquired."}},"required":["deployments","failures","leaseExpiresAt"],"description":"Acquired deployments and failures"},"SyncAcquireRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. If omitted, resolved from each deployment's managerId column."}]},"session":{"type":"string","description":"Unique session identifier for lock tracking"},"requestId":{"type":"string","minLength":1,"description":"Idempotency key for one logical acquire request"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to lock (for Pull model sync)"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment statuses (default: all deployment statuses)"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by platforms (default: all platforms the Manager supports)"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Filter by setup method for setup-owned acquisition paths"}]},"acquireMode":{"type":"string","enum":["runtime","setup-run","setup-teardown"],"description":"Phase ownership mode for deployment acquisition"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model from stackSettings.deploymentModel."},"supportsExecutionClaims":{"type":"boolean","enum":[true],"description":"Signals support for echoing executionClaim on renew, reconcile, and release."},"limit":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of deployments to acquire (default: 10)"}},"required":["session","requestId","deploymentModel"],"additionalProperties":false,"description":"Request to acquire deployments for processing"},"SyncReconcileResponse":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the state was reconciled"},"current":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Current deployment state after reconciliation"}]},"target":{"$ref":"#/components/schemas/TargetDeployment"},"targetOperationsBundleSet":{"$ref":"#/components/schemas/TargetOperationsBundleSet"},"targetDynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"deleted":{"type":"boolean"},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]},"suspendedReason":{"type":"string","maxLength":512}},"required":["name","generation","image","cpu","memory","replicas","ports","deleted","env","secretEnv"]},"description":"Complete release-independent dynamic container target set for a Kubernetes Operator."}},"required":["success","current"],"description":"State reconciliation result with optional target"},"TargetDeployment":{"type":"object","properties":{"config":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["environmentVariables"],"description":"Deployment configuration\n\nConfiguration for how to perform the deployment.\nNote: Credentials (ClientConfig) are passed separately to step() function."},"releaseInfo":{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."}},"required":["config","releaseInfo"],"description":"Target deployment if update is needed"},"TargetOperationsBundleSet":{"type":"object","properties":{"hash":{"type":"string","minLength":1,"maxLength":256},"bundles":{"type":"array","items":{"$ref":"#/components/schemas/OperationsBundleDownload"}}},"required":["hash","bundles"],"description":"Target operations-bundle set the Operator should converge its loaded plugin registry toward."},"OperationsBundleDownload":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"url":{"type":"string","format":"uri","description":"Presigned URL to GET the bundle ZIP from. Short-lived."}},"required":["plugin","pluginVersion","url"]},"SyncReconcileRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to reconcile state for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Lock session (push model only) - verifies lock ownership"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Immutable operation claimed at acquisition. Required with attemptId for update execution.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed at acquisition. Required with operationId for update execution.","example":"duat_uve04tou5eoua3q17dar1pz"},"state":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Complete deployment state after step() execution"}]},"updateHeartbeat":{"type":"boolean","description":"Update heartbeat timestamp (for successful health checks)"},"suggestedDelayMs":{"type":"integer","minimum":0,"description":"Delay before this deployment should be acquired again."},"resourceHeartbeats":{"type":"array","items":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"description":"Latest typed resource heartbeats collected during this step."},"observedInventoryBatches":{"type":"array","items":{"$ref":"#/components/schemas/ObservedInventoryBatch"},"description":"Observed raw-resource inventory batches read during this step."},"capabilities":{"type":"array","items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Operator-reported runtime capabilities."},"operatorVersion":{"type":"string","minLength":1,"maxLength":128,"description":"Operator binary version reported by the runtime."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorImageIdentity"},"operationsReport":{"$ref":"#/components/schemas/OperationsReport"},"dynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"message":{"type":"string","maxLength":2048}},"required":["name","generation","status"]},"description":"Observed dynamic container generations from a Kubernetes Operator."}},"required":["deploymentId","state"],"additionalProperties":false,"description":"Request to reconcile deployment state"},"ObservedInventoryBatch":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"],"description":"Backend whose observer produced this snapshot."},"complete":{"type":"boolean","description":"Whether this batch is a complete replacement for the scope. Complete\nbatches tombstone previously observed rows in the same scope when they\nare absent from `resources`."},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inventoryScope":{"type":"string","description":"Stable scope for the provider list operation that produced this batch."},"observedAt":{"type":"string","format":"date-time","description":"Time the inventory scope was observed."},"resources":{"type":"array","items":{"type":"object","properties":{"alienResourceId":{"type":"string","nullable":true},"attributes":{"type":"object","properties":{},"additionalProperties":{"nullable":true}},"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"counts":{"oneOf":[{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},{"nullable":true}]},"deploymentId":{"type":"string","nullable":true},"displayName":{"type":"string"},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"images":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."},"description":"Distinct container images the resource's running instances report, when\nthe provider exposes them."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerKind":{"type":"string","description":"Provider-native kind, such as `apps/v1/Deployment`,\n`AWS::S3::Bucket`, `storage.googleapis.com/Bucket`, or an Azure\nresource type."},"providerStale":{"type":"boolean"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"rawIdentity":{"type":"string","description":"Provider-native stable identity: Kubernetes object identity, cloud ARN,\nGCP full resource name, Azure resource id, etc."},"region":{"type":"string","nullable":true},"resourceTypeHint":{"oneOf":[{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},{"nullable":true}]},"scope":{"type":"string","nullable":true},"version":{"type":"string","nullable":true,"description":"Release/version identity observed from the provider resource, when available."}},"required":["displayName","health","lifecycle","partial","providerKind","providerStale","rawIdentity"]}},"sourceKind":{"type":"string","description":"Writer/source for this inventory pass, such as `operator` or\n`manager-observer`."}},"required":["backend","complete","controllerPlatform","inventoryScope","observedAt","resources","sourceKind"]},"RemoteOperatorImageIdentity":{"type":"object","properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"}},"required":["source","packageId","packageVersion","image","digest"],"additionalProperties":false,"description":"Immutable installer receipt self-reported by a running Remote Operator. This is not independent runtime image inspection."},"OperationsReport":{"type":"object","properties":{"loadedBundleHash":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"operations":{"type":"array","items":{"$ref":"#/components/schemas/ReportedOperation"},"default":[]}},"description":"Operations bundle set the Operator currently has loaded, for plugin-sync status tracking."},"SyncRenewRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Single deployment to renew. Deprecated: use deploymentIds. Retained so a manager built against the previous API keeps renewing during rollout.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"minItems":1,"maxItems":100,"description":"Deployments to renew or confirm. Renewal is per deployment: the response reports each one independently."},"claims":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Unique identifier for the deployment update attempt.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","operationId","attemptId"]},"maxItems":100,"description":"Claim identities for deployments currently executing an update."},"session":{"type":"string","minLength":1}},"required":["session"],"additionalProperties":false},"SyncReleaseRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to release","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Session identifier to release"},"mode":{"type":"string","enum":["release","acknowledge-completed"],"description":"Defaults to release. acknowledge-completed discards an exact terminal pull receipt after a lost response; it never releases newer work or grants a live lease."},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Operation returned by acquire. Required when the lease carried update work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Attempt returned by acquire. Required when the lease carried update work.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","session"],"additionalProperties":false,"description":"Request to release deployment lock"},"ResolveResponse":{"type":"object","properties":{"managerId":{"type":"string","description":"Manager ID"},"managerName":{"type":"string","description":"Manager display name"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL"},"managerIsSystem":{"type":"boolean","description":"Whether the manager is Alien-hosted"},"managerCloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where the private manager is hosted. Null for Alien-hosted managers."},"projectId":{"type":"string","description":"Resolved project ID"},"installContext":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}},"required":["platform","managementConfig"],"description":"Target install context derived from platform-managed manager metadata. Present for cloud push platforms."}},"required":["managerId","managerName","managerUrl","managerIsSystem","projectId"]},"CloudRegionsResponse":{"type":"object","properties":{"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"}},"required":["supportedRegions"]},"BillingAuditLogRow":{"type":"object","properties":{"id":{"type":"string"},"workspaceId":{"type":"string","nullable":true},"action":{"type":"string"},"payload":{"nullable":true},"createdAt":{"type":"string"}},"required":["id","workspaceId","action","createdAt"]},"WorkspaceBillingEntitlements":{"type":"object","properties":{"planId":{"$ref":"#/components/schemas/PlanId"},"planStatus":{"$ref":"#/components/schemas/BillingPlanStatus"},"features":{"$ref":"#/components/schemas/BillingFeatureFlags"},"limits":{"$ref":"#/components/schemas/BillingLimits"},"syncedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"}},"required":["planId","planStatus","features","limits","syncedAt","stale"]},"PlanId":{"type":"string","enum":["starter","pro","pro_annual","enterprise"]},"BillingPlanStatus":{"type":"string","enum":["active","trialing","past_due","canceled","none"]},"BillingFeatureFlags":{"type":"object","properties":{"custom_domains":{"type":"boolean"},"private_managers":{"type":"boolean"},"operations_custom_plugins":{"type":"boolean"},"sso_saml":{"type":"boolean"},"audit_logs":{"type":"boolean"},"airgapped":{"type":"boolean"}},"required":["custom_domains","private_managers","operations_custom_plugins","sso_saml","audit_logs","airgapped"]},"BillingLimits":{"type":"object","properties":{"maxDeployments":{"type":"number","nullable":true},"maxProjects":{"type":"number","nullable":true},"maxSeats":{"type":"number","nullable":true},"maxCustomDomains":{"type":"number","nullable":true},"creditUsd":{"type":"number","nullable":true},"seatsIncluded":{"type":"number","nullable":true}},"required":["maxDeployments","maxProjects","maxSeats","maxCustomDomains","creditUsd","seatsIncluded"]},"WorkspaceGatewayOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"summary":{"type":"object","properties":{"totalProjects":{"type":"integer","minimum":0},"gatewayProjects":{"type":"integer","minimum":0},"activeProjects":{"type":"integer","minimum":0},"setupInProgressProjects":{"type":"integer","minimum":0},"needsAttentionProjects":{"type":"integer","minimum":0},"connectedCustomers":{"type":"integer","minimum":0}},"required":["totalProjects","gatewayProjects","activeProjects","setupInProgressProjects","needsAttentionProjects","connectedCustomers"]},"projects":{"type":"array","items":{"$ref":"#/components/schemas/GatewayProjectOverview"}}},"required":["generatedAt","summary","projects"]},"GatewayProjectOverview":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"state":{"$ref":"#/components/schemas/GatewayProjectState"},"connectedCustomers":{"type":"integer","minimum":0},"settingUpCustomers":{"type":"integer","minimum":0},"needsAttentionCustomers":{"type":"integer","minimum":0},"revokedCustomers":{"type":"integer","minimum":0}},"required":["id","name","state","connectedCustomers","settingUpCustomers","needsAttentionCustomers","revokedCustomers"]},"GatewayProjectState":{"type":"string","enum":["not-set-up","setup-in-progress","active","needs-attention"]},"GatewayKind":{"type":"string","enum":["ai","encryption","sandbox"],"description":"Alien Gateway a customer deployment runs","example":"ai"}},"parameters":{}},"paths":{"/v1/invitations/{token}":{"get":{"operationId":"getWorkspaceInvitationPreview","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation preview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitationPreview"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/memberships":{"get":{"operationId":"listMemberships","description":"List all workspaces the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listMemberships","responses":{"200":{"description":"List of user's workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Membership"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile":{"get":{"operationId":"getUserProfile","description":"Get the current user's profile and user-scoped onboarding state.","x-speakeasy-group":"user","x-speakeasy-name-override":"getProfile","responses":{"200":{"description":"User profile.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateUserProfile","description":"Update the current user's profile (display name).","x-speakeasy-group":"user","x-speakeasy-name-override":"updateProfile","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"}}}}}},"responses":{"200":{"description":"Profile updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile/setup":{"post":{"operationId":"completeUserProfileSetup","description":"Complete the required beta intake and profile setup dialog.","x-speakeasy-group":"user","x-speakeasy-name-override":"completeProfileSetup","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfileSetupRequest"}}}},"responses":{"200":{"description":"Profile setup completed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/workspaces":{"post":{"operationId":"createWorkspace","description":"Create a new workspace. The current user will be automatically added as an admin.","x-speakeasy-group":"user","x-speakeasy-name-override":"createWorkspace","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name"},"logoUrl":{"type":"string","format":"uri","description":"Optional workspace logo URL"}},"required":["name"]}}}},"responses":{"201":{"description":"Created workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Membership"}}}},"400":{"description":"Bad request - invalid workspace name.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Workspace name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces":{"get":{"operationId":"listGitNamespaces","description":"List all git namespaces (GitHub installations) the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaces","parameters":[{"schema":{"type":"string","enum":["github"],"default":"github"},"required":false,"name":"provider","in":"query"}],"responses":{"200":{"description":"List of user's git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/sync":{"post":{"operationId":"syncGitNamespaces","description":"Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.","x-speakeasy-group":"user","x-speakeasy-name-override":"syncGitNamespaces","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github"],"description":"Git provider to sync"}},"required":["provider"]}}}},"responses":{"200":{"description":"Synced git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/{id}/repositories":{"get":{"operationId":"listGitNamespaceRepositories","description":"List repositories accessible through a git namespace (GitHub installation).","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaceRepositories","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","description":"Search query to filter repositories by name"},"required":false,"description":"Search query to filter repositories by name","name":"search","in":"query"}],"responses":{"200":{"description":"List of repositories.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitRepository"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Git namespace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/pending":{"get":{"operationId":"getPendingWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"required":true,"name":"workspace","in":"query"}],"responses":{"200":{"description":"An active invitation addressed to the signed-in user for this workspace, if any.","content":{"application/json":{"schema":{"type":"object","properties":{"invitationId":{"type":"string","nullable":true,"pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"}},"required":["invitationId"]}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/{token}/accept":{"post":{"operationId":"acceptWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptWorkspaceInvitationResponse"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/whoami":{"get":{"operationId":"whoami","description":"Get the current authenticated principal (user or service account). Works with both session cookies and API keys.","x-speakeasy-group":"auth","x-speakeasy-name-override":"whoami","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","example":"my-workspace"},"required":false,"description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current authenticated principal.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Subject"}}}},"400":{"description":"Missing required workspace for user credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export":{"get":{"operationId":"getProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Configuration and delivery status; headers are never returned.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string","maxLength":2048,"format":"uri"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}}},"required":["endpoint","enabled"]}}}},"responses":{"200":{"description":"Saved configuration. Changes take effect within 30 seconds.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export/test":{"post":{"operationId":"testProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Result of sending one test log to the saved destination.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}":{"get":{"operationId":"getLogExportDeliveryConfig","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"responses":{"200":{"description":"Private runtime configuration for the assigned manager.","content":{"application/json":{"schema":{"type":"object","nullable":true,"properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}},"revision":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}},"required":["endpoint","enabled","headers","revision","updatedAt"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}/status":{"post":{"operationId":"reportLogExportDelivery","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"revision":{"type":"string"},"succeeded":{"type":"boolean"},"error":{"type":"string","nullable":true,"enum":["timeout","connection","destination-rejected","invalid-destination","overflow",null]},"statusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599}},"required":["revision","succeeded","error"]}}}},"responses":{"200":{"description":"Delivery status recorded for the current configuration revision.","content":{"application/json":{"schema":{"type":"object","properties":{"accepted":{"type":"boolean"}},"required":["accepted"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces":{"get":{"operationId":"listWorkspaces","description":"Retrieve all workspaces.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search workspaces by name"},"required":false,"description":"Search workspaces by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Workspace"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}":{"get":{"operationId":"getWorkspace","description":"Retrieve a workspace by ID.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspace","description":"Update a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"}}}}}},"responses":{"200":{"description":"Workspace updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteWorkspace","description":"Delete a workspace. The workspace must have no projects.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Workspace deleted successfully."},"400":{"description":"Workspace still has projects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members":{"get":{"operationId":"listWorkspaceMembers","description":"List all members of a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"listMembers","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"List of workspace members.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceMember"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"addWorkspaceMember","description":"Add a member to a workspace by email. The user must already have an account.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"addMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email","description":"Email of the user to add"},"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"Role to assign"}]}},"required":["email","role"]}}}},"responses":{"201":{"description":"Member added successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"404":{"description":"Workspace or user not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"User is already a member.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members/{userId}":{"patch":{"operationId":"updateWorkspaceMember","description":"Update a workspace member's role.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"New role to assign"}]}},"required":["role"]}}}},"responses":{"200":{"description":"Member role updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"400":{"description":"Cannot remove last admin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"removeWorkspaceMember","description":"Remove a member from a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"removeMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Member removed successfully."},"400":{"description":"Cannot remove last admin or self.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/settings":{"get":{"operationId":"getWorkspaceSettings","description":"Read the ai-agent settings for a workspace. Returns defaults (`enabled: true`) when the workspace has never customized them.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"getSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspaceSettings","description":"Update the ai-agent settings for a workspace. Supports `enabled` (`false` turns the ai-agent off so incoming triggers are rejected before any session runs).","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkspaceSettingsRequest"}}}},"responses":{"200":{"description":"Updated ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations":{"get":{"operationId":"listWorkspaceInvitations","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Pending invitations.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceInvitation"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["email","role"]}}}},"responses":{"201":{"description":"Invitation created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"403":{"description":"Seat limit reached.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}/resend":{"post":{"operationId":"resendWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Invitation email sent again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}":{"delete":{"operationId":"revokeWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invitation revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invite-link":{"get":{"operationId":"getWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Active invite link.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"createWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["role"]}}}},"responses":{"200":{"description":"Invite link created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invite link revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects":{"get":{"operationId":"listProjects","description":"Retrieve all projects.","x-speakeasy-group":"projects","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search projects by name"},"required":false,"description":"Search projects by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deploymentCount","latestRelease"]},"description":"Optional fields to include: deploymentCount, latestRelease"},"required":false,"description":"Optional fields to include: deploymentCount, latestRelease","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved projects.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createProject","description":"Create a new project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"enabledCapabilities":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"minItems":1,"maxItems":5}},"required":["name"]}}}},"responses":{"201":{"description":"Project created successfully.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"}}}]}}}},"400":{"description":"Invalid request or GitHub repository connection failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}":{"get":{"operationId":"getProject","description":"Retrieve a project by ID or name.","x-speakeasy-group":"projects","x-speakeasy-name-override":"get","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateProject","description":"Update a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"update","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProject"}}}},"responses":{"200":{"description":"Project updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"403":{"description":"Project update permission is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this project's release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request or package settings are invalid or incomplete.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteProject","description":"Delete a project. The project must have no deployments.","x-speakeasy-group":"projects","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Project deleted successfully."},"400":{"description":"Project still has deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/gcp-oauth-provider":{"get":{"operationId":"getProjectGcpOAuthProvider","description":"Retrieve redacted project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectGcpOAuthProvider","description":"Update project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"updateGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProjectGcpOAuthProvider"}}}},"responses":{"200":{"description":"Google Cloud OAuth provider settings updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"400":{"description":"Invalid provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/source":{"post":{"operationId":"configureProjectSource","description":"Connect a GitHub repository or Alien template to an existing project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureSource","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["repository"]},"gitRepository":{"type":"object","properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","gitRepository"]},{"type":"object","properties":{"mode":{"type":"string","enum":["template"]},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","targetNamespace","templatePath"]}]}}}},"responses":{"200":{"description":"Project source connected.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}}}]}}}},"400":{"description":"Repository or template configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Template fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-portal-domain":{"get":{"operationId":"getProjectDeploymentPortalDomain","description":"Get the deployment portal domain binding for a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentPortalDomain","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment portal domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentPortalDomainResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/import-template":{"post":{"operationId":"createProjectFromTemplate","description":"Create a project by forking alienplatform/alien into your namespace.","x-speakeasy-group":"projects","x-speakeasy-name-override":"createFromTemplate","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$","description":"GitHub owner namespace (user or organization) that will receive the fork"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"}},"required":["name","targetNamespace","templatePath"]}}}},"responses":{"201":{"description":"Project created successfully from template.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}},"required":["template"]}]}}}},"400":{"description":"Bad request or GitHub integration not installed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/template-urls":{"get":{"operationId":"getProjectTemplateUrls","description":"Get template URLs for deploying setup stacks in this project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getTemplateUrls","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Template URLs retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"aws":{"type":"object","nullable":true,"properties":{"templateUrl":{"type":"string","format":"uri","description":"URL to download the CloudFormation template"},"launchStackUrl":{"type":"string","format":"uri","description":"URL to launch the template in the AWS CloudFormation console"}},"required":["templateUrl","launchStackUrl"],"description":"Template URLs for deploying an AWS setup stack"}}}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-link-setup":{"get":{"operationId":"getProjectDeploymentLinkSetup","description":"Get the active release stack and portal-visible setup availability for deployment-link configuration.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentLinkSetup","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment-link setup retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentLinkSetupResponse"}}}},"400":{"description":"The project's sandbox follows an Alien default image this environment does not configure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or active release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/active-release":{"get":{"operationId":"getProjectActiveRelease","description":"Get the production channel's current release. When deploymentId is provided, returns that deployment's effective release: its pin, or its followed channel's current release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getActiveRelease","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Optional deployment ID to check for pinned release"},"required":false,"description":"Optional deployment ID to check for pinned release","name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Effective release retrieved successfully.","content":{"application/json":{"schema":{"nullable":true}}}},"404":{"description":"Project or effective release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models/impact":{"post":{"operationId":"previewProjectModelsImpact","description":"Preview which customer model connections a configuration change may affect.","x-speakeasy-group":"projects","x-speakeasy-name-override":"previewModelsImpact","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Model configuration impact.","content":{"application/json":{"schema":{"type":"object","properties":{"connectedCustomers":{"type":"integer","minimum":0},"affectedCustomers":{"type":"integer","minimum":0},"verificationNeeded":{"type":"integer","minimum":0},"affected":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"provider":{"type":"string"},"reason":{"type":"string","enum":["provider-no-longer-compatible","required-model-not-in-catalog"]}},"required":["deploymentGroupId","name","externalId","provider","reason"]}},"truncated":{"type":"boolean"}},"required":["connectedCustomers","affectedCustomers","verificationNeeded","affected","truncated"]}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities":{"put":{"operationId":"setProjectCapabilities","description":"Set the capabilities offered by a Project. Removing a capability prevents new setup without deleting existing customer resources.","x-speakeasy-group":"projects","x-speakeasy-name-override":"setCapabilities","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"maxItems":5}},"required":["enabled"],"additionalProperties":false}}}},"responses":{"200":{"description":"The Project's enabled capabilities.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/deployments":{"put":{"operationId":"configureProjectDeployments","description":"Enable deployments for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureDeployments","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled","methods"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployments enabled for the Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-provider-headers":{"get":{"operationId":"getProjectAiProviderHeaders","description":"Get static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Static AI provider headers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"configureProjectAiProviderHeaders","description":"Replace the static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"responses":{"200":{"description":"Static AI provider headers updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"400":{"description":"Provider header configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models":{"put":{"operationId":"configureProjectModels","description":"Configure customer-owned model providers without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureModels","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Customer Models configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/keys":{"put":{"operationId":"configureProjectKeys","description":"Enable customer-owned application encryption without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["applicationEncryption"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Key configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/buckets":{"put":{"operationId":"configureProjectBuckets","description":"Enable buckets without requiring a project Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureBuckets","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"access":{"type":"string","enum":["read-write"]}},"required":["access"],"additionalProperties":false}}}},"responses":{"200":{"description":"Buckets configured and their exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/registry":{"put":{"operationId":"configureProjectRegistry","description":"Enable customer-owned container registries without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRegistry","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["repositories","credentialPolicy"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Registry configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox":{"put":{"operationId":"configureProjectRemoteSandbox","description":"Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRemoteSandbox","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureRemoteSandboxRequest"}}}},"responses":{"200":{"description":"Sandbox configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"400":{"description":"The sandbox configuration cannot be satisfied by this environment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The request body is invalid, including a per-cloud field.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The image's registry or Alien's GCP image service could not be reached, or the save's GCP image could not be queued; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox/base-image-repository":{"post":{"operationId":"ensureProjectSandboxBaseImageRepository","description":"Ensure the project's private image repository exists and return where to push a private sandbox base image. Name the pushed image as the remote sandbox base image afterwards.","x-speakeasy-group":"projects","x-speakeasy-name-override":"ensureSandboxBaseImageRepository","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Repository ready to receive a push.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SandboxBaseImageRepository"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found, or no AWS manager serves it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager could not prepare the repository.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The project's manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/overview":{"get":{"operationId":"getProjectCapabilityOverview","description":"Get safe, server-derived capability status for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getCapabilityOverview","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Project capability overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilityOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-bindings/access":{"post":{"operationId":"createRemoteBindingsExternalAccess","tags":["remote-bindings"],"summary":"Create short-lived Remote Bindings access for a external resource","description":"Selects a connected external resource by Project and external ID, then returns a short-lived deployment-scoped Manager capability. The caller never receives the external cloud credentials from Platform.","x-speakeasy-group":"remoteBindings","x-speakeasy-name-override":"createExternalAccess","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessRequest"}}}},"responses":{"200":{"description":"Short-lived Remote Bindings access was created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessResponse"}}}},"401":{"description":"The API key is missing, invalid, expired, or disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot access Remote Bindings for this Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The Project or external ID was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"More than one active external resource matched.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The external resource or its assigned Manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary":{"get":{"operationId":"getRemoteOperatorProjectSummary","tags":["projects"],"summary":"Get the authoritative Remote Operator project summary","x-speakeasy-group":"projects","x-speakeasy-name-override":"getRemoteOperatorSummary","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Authoritative Remote Operator state composed from existing owners.","content":{"application/json":{"schema":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"nextAction":{"type":"object","properties":{"kind":{"type":"string","enum":["connect","inspect","reconnect","verify","update","wait","none"]},"target":{"type":"string","enum":["setup","deployment","releases","access","operations","activity"]},"deploymentId":{"type":"string","nullable":true},"message":{"type":"string"}},"required":["kind","target","deploymentId","message"]},"installations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroupId":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs","unknown"]},"region":{"type":"string","nullable":true},"state":{"type":"string","enum":["unhealthy","stale","connecting","unverified","verified"]},"stateReason":{"type":"string"},"status":{"type":"string"},"lastHeartbeatAt":{"type":"string","nullable":true,"format":"date-time"},"lastSuccessfulDiagnosticAt":{"type":"string","nullable":true,"format":"date-time"},"operatorVersion":{"type":"string","nullable":true},"operatorScope":{"type":"string","nullable":true},"operatorPermission":{"type":"string","nullable":true},"expectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"previousExpectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"runningImage":{"$ref":"#/components/schemas/ObservedRemoteOperatorImageIdentity"},"imageStatus":{"type":"string","enum":["matching","drifted","unreported","unconfigured"]},"operatorUpdate":{"type":"object","nullable":true,"properties":{"packageId":{"type":"string"},"packageVersion":{"type":"string"},"image":{"type":"string"},"digest":{"type":"string"},"builtAt":{"type":"string","format":"date-time"}},"required":["packageId","packageVersion","image","digest","builtAt"],"description":"The ready Operator image selected by the project's current configuration when it differs from the image this installation was set up with. Re-applying setup installs it. Null when the installation already uses it, its install identity is unknown, or the selected package is not ready."},"operationSync":{"type":"object","nullable":true,"properties":{"status":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"string","nullable":true}},"required":["status","targetBundleHash","observedBundleHash","targetSetAt","observedAt","error"]},"application":{"type":"object","properties":{"state":{"type":"string","enum":["no-desired","up-to-date","update-required","unknown","failed"],"description":"How the application release the Operator reports compares with the desired release. Alien never applies the change; the customer applies it through their own release process."},"reason":{"type":"string"},"reported":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The application release the Operator reports"},"desired":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["channel","pin"]},"helmChart":{"type":"object","nullable":true,"properties":{"chart":{"type":"string"},"version":{"type":"string"}},"required":["chart","version"],"description":"The Helm chart built for this release, when the release has one"},"images":{"type":"array","items":{"type":"string"},"description":"Container images the release records for AWS, in resource order"}},"required":["releaseId","version","source","helmChart","images"],"description":"The release the deployment should run: its pinned release or its channel's release"},"releaseChannel":{"type":"string","description":"The release channel the deployment follows when unpinned"},"rollback":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The release the deployment reported before it moved to the desired release"}},"required":["state","reason","reported","desired","releaseChannel","rollback"]},"permissions":{"type":"object","properties":{"status":{"type":"string","enum":["current","outdated","unknown"],"description":"Whether the Kubernetes RBAC and cloud IAM recorded for this installation match the permissions compiled from the currently enabled operations."},"recordedAt":{"type":"string","nullable":true,"format":"date-time","description":"When setup was issued or last re-applied; null when nothing was recorded."},"reason":{"type":"string"}},"required":["status","recordedAt","reason"],"description":"Installed cloud and Kubernetes permissions. Setup applies them, so enabling or disabling operations changes them only after the installation's setup is re-applied."}},"required":["id","name","deploymentGroupId","platform","region","state","stateReason","status","lastHeartbeatAt","lastSuccessfulDiagnosticAt","operatorVersion","operatorScope","operatorPermission","expectedImage","previousExpectedImage","runningImage","imageStatus","operatorUpdate","operationSync","application","permissions"]}},"unregisteredSetups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs"]},"createdAt":{"type":"string","format":"date-time"},"valuesExpireAt":{"type":"string","nullable":true,"format":"date-time","description":"When the newest installation values stop working. Resuming setup can replace them."}},"required":["deploymentGroupId","name","platform","createdAt","valuesExpireAt"]},"description":"Setups whose installation values were created but whose Operator never registered, newest first."}},"required":["items","unregisteredSetups"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"release":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"reported":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"deployments":{"type":"integer","minimum":0,"exclusiveMinimum":true},"latest":{"type":"boolean"}},"required":["releaseId","version","createdAt","deployments","latest"]},"description":"Application releases that Remote Operator deployments report, newest first. The newest reported release is latest."},"older":{"type":"integer","minimum":0,"description":"Deployments without a desired release that report a release older than the latest reported release"},"unknown":{"type":"integer","minimum":0,"description":"Deployments that report no application release"},"rollout":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"upToDate":{"type":"integer","minimum":0},"waiting":{"type":"integer","minimum":0},"unknown":{"type":"integer","minimum":0},"failed":{"type":"integer","minimum":0}},"required":["releaseId","version","upToDate","waiting","unknown","failed"]},"description":"Desired releases, most deployments first, with how many Remote Operator deployments run each one, still need the change, report no release, or failed after it"}},"required":["reported","older","unknown","rollout"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"access":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"pending":{"type":"integer","minimum":0},"active":{"type":"integer","minimum":0},"recent":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"approvedUntil":{"type":"string","nullable":true,"format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","title","status","approvedUntil","updatedAt"]}}},"required":["pending","active","recent"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"operations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"selected":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["builtin","custom"]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]}},"required":["name","tier"]}}},"required":["name","version","source","operations"]}},"sync":{"type":"object","properties":{"preparing":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"ready":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["preparing","syncing","ready","stuck"]},"generatedPermissions":{"type":"array","items":{"type":"object","properties":{"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]},"cloud":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetes":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["plugin","pluginVersion","operation","tier","cloud"]}}},"required":["selected","sync","generatedPermissions"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"activity":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"recent":{"type":"array","items":{"type":"object","properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string","nullable":true},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","nullable":true},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt"]}},"investigations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"deploymentId":{"type":"string"},"status":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","triggerType","deploymentId","status","createdAt","updatedAt"]},"description":"Recent agent sessions about Remote Operator deployments or their access requests"},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"state":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","state","createdAt","expiresAt"]}},"lastVerifiedOperation":{"type":"object","nullable":true,"properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string"},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","enum":["SUCCEEDED"]},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verification":{"type":"object","properties":{"state":{"type":"string","enum":["not-required","verified","skipped"]},"attempts":{"type":"integer","minimum":0},"maxAttempts":{"type":"integer","minimum":0},"deadline":{"type":"string","nullable":true,"format":"date-time"},"reason":{"type":"string","nullable":true}},"required":["state","attempts","maxAttempts","deadline","reason"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"resultAvailable":{"type":"boolean"},"result":{"nullable":true},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt","verification","sensitiveOutput","resultAvailable","completedAt"]}},"required":["recent","investigations","debugSessions","lastVerifiedOperation"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]}},"required":["generatedAt","project","nextAction","installations","release","access","operations","activity"]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-image":{"post":{"operationId":"acceptRemoteOperatorImage","tags":["projects"],"summary":"Accept a reported image for a Remote Operator installation","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorImage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"responses":{"200":{"description":"The observed immutable image is now the accepted desired image.","content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"400":{"description":"The deployment is not a Remote Operator installation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The requested image is not the image in the latest Operator heartbeat.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-permissions":{"post":{"operationId":"acceptRemoteOperatorPermissions","tags":["projects"],"summary":"Record that a Remote Operator installation's setup was re-applied","description":"Records the permissions compiled from the currently enabled operations as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorPermissions","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"reviewedPermissions":{"type":"array","items":{"$ref":"#/components/schemas/RemoteOperatorPermissionPlugin"},"description":"The enabled operations' permission declarations that the owner reviewed and re-applied."}},"required":["reviewedPermissions"]}}}},"responses":{"200":{"description":"The current permissions are recorded as installed.","content":{"application/json":{"schema":{"type":"object","properties":{"recordedAt":{"type":"string","format":"date-time"}},"required":["recordedAt"]}}}},"400":{"description":"The deployment is not a Kubernetes or ECS Remote Operator installation, or an enabled operation is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The enabled operations changed after the reviewed permissions were loaded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-metrics":{"get":{"operationId":"getProjectAiUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe AI Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"pricing":{"type":"object","properties":{"label":{"type":"string","enum":["Estimated provider cost"]},"coverage":{"type":"number","minimum":0,"maximum":1},"revision":{"type":"string","nullable":true}},"required":["label","coverage","revision"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","deploymentGroupId","name","externalId"]}},"models":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"publicModel":{"type":"string"},"provider":{"type":"string"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","publicModel","provider"]}},"customersTruncated":{"type":"boolean"},"modelsTruncated":{"type":"boolean"}},"required":["status","range","pricing","totals","timeSeries","customers","models","customersTruncated","modelsTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/encryption-metrics":{"get":{"operationId":"getProjectEncryptionUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getEncryptionUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Encryption Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","bucket"]}},"operations":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"operation":{"type":"string","enum":["encrypt","decrypt"]}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","operation"]}}},"required":["status","range","totals","timeSeries","operations"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/sandbox-metrics":{"get":{"operationId":"getProjectSandboxMetrics","x-speakeasy-group":"projects","x-speakeasy-name-override":"getSandboxMetrics","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Sandbox Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"externalId":{"type":"string","nullable":true},"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"lastSeenAt":{"type":"string","format":"date-time"}},"required":["deploymentGroupId","externalId","sessions","commands","lastSeenAt"]}},"customersTruncated":{"type":"boolean"}},"required":["status","range","totals","timeSeries","customers","customersTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups":{"post":{"operationId":"createDeploymentGroup","tags":["deployment-groups"],"summary":"Create a new deployment group","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group with this name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentGroups","tags":["deployment-groups"],"summary":"List deployment groups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of deployment groups","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"}}}]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-name":{"put":{"operationId":"ensureDeploymentGroupByName","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and name","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByNameRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-external-id":{"put":{"operationId":"ensureDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Optional for project-scoped API keys."},"required":false,"description":"Project ID or name. Optional for project-scoped API keys.","name":"project","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"required":true,"description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","name":"externalId","in":"query"}],"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project or deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/setup-links":{"post":{"operationId":"createSetupLink","tags":["setup-links"],"summary":"Create a customer setup link","description":"Ensures the Deployment Group identified by Project and external ID, then creates a group-scoped setup link with exact captured sources.","x-speakeasy-group":"setupLinks","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkRequest"}}}},"responses":{"200":{"description":"Customer environment ensured and setup link created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkResponse"}}}},"400":{"description":"Customer environment or setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Customer environment name or setup source conflicts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}":{"get":{"operationId":"getDeploymentGroup","tags":["deployment-groups"],"summary":"Get deployment group details","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"}],"responses":{"200":{"description":"Deployment group details","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"deploymentCount":{"type":"integer","description":"Current number of deployments in this deployment group"}},"required":["deploymentCount"]}]}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentGroup","tags":["deployment-groups"],"summary":"Update deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDeploymentGroup","tags":["deployment-groups"],"summary":"Delete deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Deployment group deleted successfully"},"400":{"description":"Cannot delete deployment group that has deployments","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/external-id":{"put":{"operationId":"setDeploymentGroupExternalId","tags":["deployment-groups"],"summary":"Set or clear a deployment group's external ID","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetDeploymentGroupExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group external ID updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group external ID already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/tokens":{"post":{"operationId":"createDeploymentGroupToken","tags":["deployment-groups"],"summary":"Create deployment group token","description":"Creates a deployment-group scoped API key and returns both the token and formatted deployment link","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenRequest"}}}},"responses":{"200":{"description":"Deployment group token created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"}}}},"400":{"description":"Deployment setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The project's sandbox configuration changed concurrently; retry the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/first-party-session":{"post":{"operationId":"createFirstPartyDeploymentSession","tags":["deployment-groups"],"summary":"Create first-party deployment session","description":"Mints a short-lived deployment-group token with the recommended self-deploy policy for the authenticated developer.","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"First-party deployment session created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateFirstPartyDeploymentSessionResponse"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external":{"get":{"operationId":"getExternalAIBinding","tags":["deployment-groups"],"summary":"Get external AI connection state","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"External AI connection state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBindingState"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putExternalAIBinding","tags":["deployment-groups"],"summary":"Connect or rotate an external AI provider key","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutExternalAIBindingRequest"}}}},"responses":{"202":{"description":"External AI connection stored and queued for checking","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBinding"}}}},"400":{"description":"The key is not valid for the selected provider","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The group already has an active cloud AI source","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Provider verification is temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteExternalAIBinding","tags":["deployment-groups"],"summary":"Revoke the external AI connection","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"External AI connection revoked"},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/models/{publicModelId}/checks":{"post":{"operationId":"createExternalAIModelCheck","tags":["deployment-groups"],"summary":"Queue an explicit external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":256},"required":true,"name":"publicModelId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"The potentially billable model check was queued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"400":{"description":"The model is not configured for this project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or binding not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/model-checks/{checkId}":{"get":{"operationId":"getExternalAIModelCheck","tags":["deployment-groups"],"summary":"Get an external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"checkId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Model check state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or check not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry":{"get":{"operationId":"getContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Container registry state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryState"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1,"maxLength":128}},"required":["deploymentId","resourceId"]}}}},"responses":{"200":{"description":"Registry route","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories":{"post":{"operationId":"createContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"}},"required":["name"]}}}},"responses":{"201":{"description":"Repository requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials":{"post":{"operationId":"createContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":64},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"minItems":1,"maxItems":100},"expiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["label","scope"]}}}},"responses":{"201":{"description":"Credential created; password is returned once","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateContainerRegistryCredentialResponse"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials/{credentialId}":{"delete":{"operationId":"revokeContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"required":true,"description":"Unique identifier for the container registry credential.","name":"credentialId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Credential revoked"},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories/{repositoryId}":{"delete":{"operationId":"deleteContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"required":true,"description":"Unique identifier for the container registry repository.","name":"repositoryId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"confirmName":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"disposition":{"type":"string","enum":["preserve","deleteContents"]}},"required":["confirmName","disposition"]}}}},"responses":{"202":{"description":"Repository deletion requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/verify":{"post":{"operationId":"verifyContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Verification requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/revoke":{"post":{"operationId":"revokeContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Registry revocation requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages":{"get":{"operationId":"listPackages","description":"List packages with optional filters. Returns packages ordered by creation date (newest first).","x-speakeasy-group":"packages","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Filter by package type"},"required":false,"description":"Filter by package type","name":"type","in":"query"},{"schema":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Filter by package status"},"required":false,"description":"Filter by package status","name":"status","in":"query"},{"schema":{"type":"string","pattern":"^rel_[0-9a-zA-Z]{28}$","description":"Filter by source release"},"required":false,"description":"Filter by source release","name":"sourceReleaseId","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search packages by type or version"},"required":false,"description":"Search packages by type or version","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of packages.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Package"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}":{"get":{"operationId":"getPackage","description":"Get details of a specific package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/rebuild":{"post":{"operationId":"rebuildPackages","description":"Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.","x-speakeasy-group":"packages","x-speakeasy-name-override":"rebuild","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to rebuild packages for"}},"required":["project"]}}}},"responses":{"200":{"description":"Packages rebuilt successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"packagesCreated":{"type":"integer","description":"Number of packages created"}},"required":["packagesCreated"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle the release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}/cancel":{"post":{"operationId":"cancelPackage","description":"Cancel a pending or building package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"cancel","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package canceled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"400":{"description":"Package cannot be canceled (not in pending or building status).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases":{"get":{"operationId":"listReleases","description":"Retrieve all releases.","x-speakeasy-group":"releases","x-speakeasy-name-override":"list","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","description":"Filter to releases promoted to this channel. Defaults to production."},"required":false,"description":"Filter to releases promoted to this channel. Defaults to production.","name":"channel","in":"query"},{"schema":{"type":"string","enum":["true","false"],"default":"false"},"required":false,"name":"allChannels","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search releases by commit message, branch, SHA, or release ID"},"required":false,"description":"Search releases by commit message, branch, SHA, or release ID","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by git branch (commitRef)"},"required":false,"description":"Filter by git branch (commitRef)","name":"branch","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by commit author login or name"},"required":false,"description":"Filter by commit author login or name","name":"author","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created after this date (ISO 8601)"},"required":false,"description":"Filter releases created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created before this date (ISO 8601)"},"required":false,"description":"Filter releases created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved releases.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createRelease","description":"Create a new release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateReleaseRequest"}}}},"responses":{"201":{"description":"Release created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Release"}}}},"400":{"description":"Invalid release request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/branches":{"get":{"operationId":"listReleaseBranches","description":"List distinct git branches across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listBranches","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search branches by name (case-insensitive contains)"},"required":false,"description":"Search branches by name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of branches to return"},"required":false,"description":"Maximum number of branches to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct branches.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/authors":{"get":{"operationId":"listReleaseAuthors","description":"List distinct commit authors across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listAuthors","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search authors by login or name (case-insensitive contains)"},"required":false,"description":"Search authors by login or name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of authors to return"},"required":false,"description":"Maximum number of authors to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct authors.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseAuthorFilterItem"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}":{"get":{"operationId":"getRelease","description":"Retrieve a release by ID.","x-speakeasy-group":"releases","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseListItemResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}/deployments":{"get":{"operationId":"listReleaseDeployments","description":"List the project's deployments with their rollout state relative to this release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseRolloutState"},"description":"Filter deployments by rollout state"},"required":false,"description":"Filter deployments by rollout state","name":"state","in":"query"},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved release deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseDeploymentsResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels":{"get":{"operationId":"listReleaseChannels","summary":"List release channels","description":"List the release channels configured for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Project release channels.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannel"}}},"required":["items"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createReleaseChannel","summary":"Create a release channel","description":"Create a release channel for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["name"],"additionalProperties":false}}}},"responses":{"201":{"description":"Channel created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"400":{"description":"Invalid release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}/promote":{"post":{"operationId":"promoteRelease","x-speakeasy-group":"releases","x-speakeasy-name-override":"promote","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"expectedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["releaseId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Release promoted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"404":{"description":"Project, channel, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel changed concurrently, or the sandbox bundle its release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}":{"delete":{"operationId":"deleteReleaseChannel","summary":"Delete a release channel","description":"Delete a release channel from a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"204":{"description":"Channel deleted."},"400":{"description":"Reserved channel.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel is still followed by deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments":{"get":{"operationId":"listDeployments","description":"Retrieve all deployments.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"list","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Filter by exact deployment name. Must be used with deploymentGroup."},"required":false,"description":"Filter by exact deployment name. Must be used with deploymentGroup.","name":"name","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name, public subdomain, or deployment group name"},"required":false,"description":"Search deployments by name, public subdomain, or deployment group name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved deployments.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid deployment list filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDeployment","description":"Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewDeploymentRequest"}}}},"responses":{"200":{"description":"Existing deployment returned for idempotent deployment-group registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"201":{"description":"Deployment created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"400":{"description":"Bad request - deployment group has reached max deployments limit.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden - insufficient permissions to create deployments in this context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment group not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/stats":{"get":{"operationId":"getDeploymentStats","description":"Get aggregated deployment statistics. Returns total count and breakdown by status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getStats","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name or deployment group name"},"required":false,"description":"Search deployments by name or deployment group name","name":"search","in":"query"}],"responses":{"200":{"description":"Deployment statistics retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentStats"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-environments":{"get":{"operationId":"listDeploymentFilterEnvironments","description":"List distinct effective environments used by deployments. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterEnvironments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Distinct environments retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-deployment-groups":{"get":{"operationId":"listDeploymentFilterDeploymentGroups","description":"List deployment groups with deployment counts. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterDeploymentGroups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return"},"required":false,"description":"Maximum number of items to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Deployment groups for filter retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"deploymentCount":{"type":"number"},"runningCount":{"type":"number","description":"Number of deployments in 'running' status"},"failedCount":{"type":"number","description":"Number of deployments in a failed status"},"inProgressCount":{"type":"number","description":"Number of deployments in an in-progress status (provisioning, updating, etc.)"}},"required":["id","name","deploymentCount","runningCount","failedCount","inProgressCount"]}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}":{"get":{"operationId":"getDeployment","description":"Retrieve a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentDetailResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/update-operations/{operationId}":{"get":{"operationId":"getDeploymentUpdateOperation","description":"Retrieve a deployment update operation by its durable operation ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getUpdateOperation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"required":true,"description":"Unique identifier for the deployment update operation.","name":"operationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment update operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}}}},"403":{"description":"The credential cannot read this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or update operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/info":{"get":{"operationId":"getDeploymentConnectionInfo","description":"Get deployment connection information including command endpoint and resource URLs.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment connection information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentConnectionInfo"}}}},"400":{"description":"Deployment not ready (no manager assigned).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/import":{"post":{"operationId":"importDeployment","description":"Import a deployment from resolved setup infrastructure such as CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"import","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportDeploymentRequest"}}}},"responses":{"200":{"description":"Deployment import was idempotent and returned an existing deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"201":{"description":"Deployment imported and created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/first-party-inputs":{"put":{"operationId":"setFirstPartyDeploymentInputs","description":"Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setFirstPartyDeploymentInputs","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Input values stored on the session token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsResponse"}}}},"400":{"description":"A deployment-group token scope is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The token is not a first-party deployment session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The requested release channel does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to store input values.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations":{"post":{"operationId":"createSetupRegistrationOperation","description":"Start a durable setup registration operation for CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createSetupRegistrationOperation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupRegistrationOperationRequest"}}}},"responses":{"202":{"description":"Setup registration operation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"400":{"description":"Invalid setup registration operation request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The credential cannot manage this setup registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed before callback acceptance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations/{id}":{"get":{"operationId":"getSetupRegistrationOperation","description":"Get setup registration operation status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getSetupRegistrationOperation","parameters":[{"schema":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"required":true,"description":"Unique identifier for the setup registration operation.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Setup registration operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"403":{"description":"The credential cannot read this setup registration result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Setup registration operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/delete":{"post":{"operationId":"deleteDeployment","description":"Delete, detach, or forget a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentRequest"}}}},"responses":{"202":{"description":"Deployment deletion request accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentResponse"}}}},"400":{"description":"Cannot delete the deployment in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/redeploy":{"post":{"operationId":"redeployDeployment","description":"Redeploy a running deployment with the same release and fresh environment variables. Sets status to update-pending.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"redeploy","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment redeployment triggered successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["message","operation"]}}}},"400":{"description":"Cannot redeploy - deployment must be running.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/pin-release":{"post":{"operationId":"pinDeploymentRelease","description":"Pin or unpin a running or runtime-failed deployment. Running deployments start an update; failed deployments retry toward the selected release.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"pinRelease","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PinReleaseRequest"}}}},"responses":{"202":{"description":"Release pin updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot pin release from the deployment's current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/release-channel":{"post":{"operationId":"setDeploymentReleaseChannel","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setReleaseChannel","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"channel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["channel"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployment release channel updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"400":{"description":"Channel release is unavailable for the deployment platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/retry":{"post":{"operationId":"retryDeployment","description":"Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"retry","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment retry enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Deployment is not in a failed state that can be retried.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment retry conflicts with current execution state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/inputs":{"get":{"operationId":"getDeploymentInputs","description":"Get the active input definitions and current non-secret values for a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment inputs returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInputsResponse"}}}},"403":{"description":"Insufficient permission to read deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentInputs","description":"Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Deployment inputs saved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsResponse"}}}},"400":{"description":"Input values are invalid for the deployment release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, project, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/compute":{"patch":{"operationId":"updateDeploymentCompute","description":"Update deployment-time compute pool selections and request reconciliation by the hosted manager.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateCompute","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentComputeRequest"}}}},"responses":{"200":{"description":"Compute settings saved or already current.","content":{"application/json":{"schema":{"type":"object","properties":{"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["outcome","operation"]}}}},"400":{"description":"Compute settings cannot be changed from the current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update compute settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/environment-variables":{"patch":{"operationId":"updateDeploymentEnvironmentVariables","description":"Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateEnvironmentVariables","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentEnvironmentVariablesRequest"}}}},"responses":{"202":{"description":"Environment variables updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Environment variables are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update environment variables.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/token":{"post":{"operationId":"createDeploymentToken","description":"Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenRequest"}}}},"responses":{"201":{"description":"Deployment token created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenResponse"}}}},"403":{"description":"Forbidden - insufficient permissions to issue a deployment token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}":{"put":{"operationId":"putDynamicContainer","description":"Create or replace a dynamic container in an existing deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"put","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string"},"required":false,"name":"if-match","in":"header"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutDynamicContainerRequest"}}}},"responses":{"202":{"description":"Desired state saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Generation conflict.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"501":{"description":"This deployment does not support dynamic containers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDynamicContainer","description":"Get one dynamic container's desired generation, status, and internal address.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic container.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDynamicContainer","description":"Remove a dynamic container from this deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"deleted":{"type":"boolean","enum":[true]}},"required":["name","deleted"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers":{"get":{"operationId":"listDynamicContainers","description":"List containers created after this deployment was installed.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic containers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}/logs":{"get":{"operationId":"getDynamicContainerLogs","description":"Read recent logs for one dynamic container.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"logs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":10080,"default":60},"required":false,"name":"sinceMinutes","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":200,"default":100},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"}],"responses":{"200":{"description":"Container logs.","content":{"application/json":{"schema":{"type":"object","properties":{"logs":{"type":"array","items":{"type":"object","properties":{"timestamp":{"type":"string","format":"date-time"},"level":{"type":"string"},"message":{"type":"string"},"replicaId":{"type":"string","nullable":true}},"required":["timestamp","level","message","replicaId"]}},"numHits":{"type":"number"},"nextCursor":{"type":"string","nullable":true},"partial":{"type":"boolean"},"errorCount":{"type":"number"}},"required":["logs","numHits","nextCursor","partial","errorCount"]}}}},"400":{"description":"Invalid cursor or time range.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Logs are unavailable for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/machines":{"get":{"operationId":"listDeploymentMachines","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listMachines","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines in every Horizon-backed ComputeCluster for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListDeploymentMachinesResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Horizon inventory could not be read.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation":{"get":{"operationId":"getDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current non-secret rotation state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationStatus"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"prepareDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"expectedRevision":{"type":"integer","minimum":0,"maximum":2147483644}},"required":["expectedRevision"],"additionalProperties":false}}}},"responses":{"200":{"description":"Prepared or replayed rotation; download values explicitly","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/cancel":{"post":{"operationId":"cancelDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Cancelled; apply the newer rollback values to restore the old credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/values":{"post":{"operationId":"getDeploymentCredentialRotationValues","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Secret values for this exact current rotation. Never persist in browser storage.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationValues"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers":{"post":{"operationId":"createManager","description":"Create a new manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewManagerRequest"}}}},"responses":{"201":{"description":"Manager created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Invalid private manager setup method.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A manager for this target already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listManagers","description":"Retrieve all managers.","x-speakeasy-group":"managers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search managers by name"},"required":false,"description":"Search managers by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of managers to return"},"required":false,"description":"Maximum number of managers to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved managers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Manager"}}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/setup-token":{"post":{"operationId":"retryManagerSetup","description":"Revoke previous private-manager setup tokens and issue a fresh setup token/config.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retrySetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"201":{"description":"Fresh manager setup token generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Manager setup cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or setup config not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/retry":{"post":{"operationId":"retryManager","description":"Retry private-manager setup. Returns a fresh setup action before the internal deployment exists, or requests retry for the internal deployment after it exists.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retry","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager retry handled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerRetryResponse"}}}},"400":{"description":"Manager cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or internal deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/cancel-setup":{"post":{"operationId":"cancelManagerSetup","description":"Cancel pending private-manager setup, revoke setup/runtime tokens, and remove the undeployed manager record.","x-speakeasy-group":"managers","x-speakeasy-name-override":"cancelSetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager setup canceled successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Manager setup cannot be canceled in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}":{"get":{"operationId":"getManager","description":"Retrieve a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"get","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Manager"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteManager","description":"Delete a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager deletion enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot delete the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Internal deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/domain-binding":{"get":{"operationId":"getManagerDomainBinding","description":"Get the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager domain binding.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateManagerDomainBinding","description":"Create, update, or remove the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"updateDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerDomainBinding"}}}},"responses":{"200":{"description":"Manager domain binding updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"400":{"description":"Invalid domain binding request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or domain not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/management-config":{"get":{"operationId":"getManagerManagementConfig","description":"Get the management configuration for a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getManagementConfig","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":true,"description":"Represents the target cloud platform.","name":"platform","in":"query"}],"responses":{"200":{"description":"Management config retrieved successfully.","content":{"application/json":{"schema":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/provision":{"post":{"operationId":"provisionManager","description":"Enqueue provisioning for a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"provision","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager provisioning enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot provision the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/update":{"post":{"operationId":"updateManager","description":"Update a manager to a specific release ID or active release.","x-speakeasy-group":"managers","x-speakeasy-name-override":"update","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerRequest"}}}},"responses":{"202":{"description":"Manager update enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot update the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/events":{"get":{"operationId":"listManagerEvents","description":"Retrieve all events of a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"listEvents","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Event"}}},"required":["items"]}}}},"400":{"description":"Manager does not expose user-accessible events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/token":{"post":{"operationId":"generateManagerToken","description":"Generate a short-lived JWT for direct browser → manager communication. Used for fetching command payloads and querying logs without routing sensitive data through the platform API.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenRequest"}}}},"responses":{"200":{"description":"Manager access token and connection info.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/binding-token":{"post":{"operationId":"generateManagerBindingToken","description":"Generate a short-lived deployment-scoped token for resolving opted-in remote bindings through the currently assigned manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerBindingToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenRequest"}}}},"responses":{"200":{"description":"Remote Bindings token and assigned manager URL.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenResponse"}}}},"403":{"description":"The caller cannot access Remote Bindings for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Assigned manager or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A sandbox token was requested but the deployment's current release publishes no remote sandbox, or more than one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed, such as an unknown binding kind.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/gcp-oauth-provider/resolve":{"post":{"operationId":"resolveManagerGcpOAuthProvider","description":"Resolve decrypted project-level Google Cloud OAuth provider settings for a manager-side deployment bootstrap.","x-speakeasy-group":"managers","x-speakeasy-name-override":"resolveGcpOAuthProvider","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderRequest"}}}},"responses":{"200":{"description":"Resolved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderResponse"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Manager cannot resolve this deployment group's project settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/heartbeat":{"post":{"operationId":"reportManagerHeartbeat","description":"Report Manager health status and metrics.","x-speakeasy-group":"managers","x-speakeasy-name-override":"reportHeartbeat","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatRequest"}}}},"responses":{"200":{"description":"Heartbeat acknowledged.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/deployment":{"get":{"operationId":"getManagerDeployment","description":"Get deployment details for a private manager (internal deployment platform, status, resources).","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDeployment","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager deployment details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDeployment"}}}},"404":{"description":"Manager not found or has no internal deployment (alien-hosted managers don't have deployment info).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/snapshot":{"get":{"operationId":"getContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"responses":{"200":{"description":"Complete desired registry snapshot assigned to this Manager","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryManagerSnapshot"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/applied":{"post":{"operationId":"applyContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"routeId":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"desiredRevision":{"type":"integer","minimum":0},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"status":{"type":"string","enum":["ready","deleted","failed"]},"routableUpstreamName":{"type":"string","nullable":true,"minLength":1},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["id","status","routableUpstreamName","error"],"additionalProperties":false}},"verification":{"type":"object","nullable":true,"properties":{"succeeded":{"type":"boolean"},"observedAt":{"type":"string","format":"date-time"},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["succeeded","observedAt","error"],"additionalProperties":false}},"required":["routeId","desiredRevision","repositories","verification"],"additionalProperties":false}}}},"responses":{"200":{"description":"Applied registry snapshot revision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplyContainerRegistrySnapshotResponse"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/prepare":{"post":{"operationId":"prepareOperatorManifestPackage","tags":["operator-manifests"],"summary":"Prepare the white-labeled Operator image for an Operate install","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageRequest"}}}},"responses":{"200":{"description":"Operator image package created or reused.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/render":{"post":{"operationId":"renderOperatorManifest","tags":["operator-manifests"],"summary":"Render a Kubernetes Operator manifest","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestRequest"}}}},"responses":{"200":{"description":"Operator manifest rendered successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestResponse"}}}},"400":{"description":"An enabled custom plugin has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Operator image package is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid platform or manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/bootstrap-write-check":{"post":{"operationId":"checkEcsBootstrapWrite","tags":["operator-manifests"],"description":"Checks a Remote Operator setup token and its exact AWS target before the local bootstrap command writes a registration secret. A registered stack cannot use this path.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EcsBootstrapWriteCheckRequest"}}}},"responses":{"204":{"description":"The setup token may write the bootstrap secret."},"400":{"description":"The AWS target is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"The setup token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The setup token cannot read this deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The setup token does not match the target or the stack has registered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/render":{"post":{"operationId":"renderOperatorEcsCloudFormation","tags":["operator-manifests"],"summary":"Render a Remote Operator ECS Fargate CloudFormation installer","description":"Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from the project's enabled operations; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationRequest"}}}},"responses":{"200":{"description":"CloudFormation installer rendered, or null template and deployCommand while imagePending is true.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationResponse"}}}},"400":{"description":"Enabled AWS permissions cannot be safely compiled or directly deployed with the supplied resource ceilings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not authorized to update the project or use the selected Operator image package.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Operator image package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The selected Operator image package is unavailable, or the registered stack belongs to a different ECS cluster.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request body validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid Operator image or AWS manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys":{"get":{"operationId":"listAPIKeys","description":"Retrieve all API keys for the current workspace.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved API keys.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/APIKey"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAPIKey","description":"Create a new API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyRequest"}}}},"responses":{"201":{"description":"API key created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyResponse"}}}},"403":{"description":"Insufficient permissions to create API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/{id}":{"get":{"operationId":"getAPIKey","description":"Retrieve a specific API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateAPIKey","description":"Update an API key (enable/disable, change description).","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateAPIKeyRequest"}}}},"responses":{"200":{"description":"API key updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeAPIKey","description":"Revoke (soft delete) an API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"revoke","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"API key revoked successfully."},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/batch-delete":{"post":{"operationId":"deleteAPIKeys","description":"Permanently delete multiple API keys.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"deleteMultiple","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteAPIKeysRequest"}}}},"responses":{"200":{"description":"API keys deleted successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"deletedCount":{"type":"number"}},"required":["deletedCount"]}}}},"403":{"description":"Insufficient permissions to delete API keys.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains":{"get":{"operationId":"listDomains","description":"List system domains and workspace domains.","x-speakeasy-group":"domains","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domains.","content":{"application/json":{"schema":{"type":"object","properties":{"domains":{"type":"array","items":{"$ref":"#/components/schemas/DomainWithUsage"}}},"required":["domains"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDomain","description":"Create a workspace domain and optional initial endpoints.","x-speakeasy-group":"domains","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"setup":{"type":"object","properties":{"deploymentPortal":{"type":"boolean"},"packages":{"type":"boolean"},"deploymentUrlProjectId":{"type":"string","nullable":true,"pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"managerIds":{"type":"array","items":{"type":"string"}}}}},"required":["domain"]}}}},"responses":{"200":{"description":"Returned an existing workspace domain claim.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"201":{"description":"Created domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Domain is reserved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/endpoints":{"post":{"operationId":"createDomainEndpoint","description":"Create an endpoint under a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"createEndpoint","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"owner":{"type":"object","properties":{"type":{"type":"string","enum":["workspace","project","manager"]},"id":{"type":"string"}},"required":["type","id"]}},"required":["kind"]}}}},"responses":{"201":{"description":"Created endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Bad request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Endpoint cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}":{"get":{"operationId":"getDomain","description":"Get domain by ID.","x-speakeasy-group":"domains","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDomain","description":"Delete a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}},"required":["success"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain is in use.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/refresh":{"post":{"operationId":"refreshDomain","description":"Refresh workspace domain verification.","x-speakeasy-group":"domains","x-speakeasy-name-override":"refresh","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain verification refresh requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events":{"get":{"operationId":"listEvents","description":"Retrieve all events.","x-speakeasy-group":"events","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter events to a single deployment."},"required":false,"description":"Filter events to a single deployment.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Filter events to a single release."},"required":false,"description":"Filter events to a single release.","name":"releaseId","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["releaseCreatedAt"]},"description":"Optional fields to include: releaseCreatedAt"},"required":false,"description":"Optional fields to include: releaseCreatedAt","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/EventListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events/{id}":{"get":{"operationId":"getEvent","description":"Retrieve an event by ID.","x-speakeasy-group":"events","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"required":true,"description":"Unique identifier for the event.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved event.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Event"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents":{"get":{"operationId":"listIncidents","description":"List authorized incidents without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string"},"required":false,"name":"projectId","in":"query"},{"schema":{"type":"string","enum":["queued","running","halted","complete","error","canceled"]},"required":false,"name":"status","in":"query"},{"schema":{"type":"string","maxLength":256},"required":false,"name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":25},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incidents.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentListResponse"}}}},"400":{"description":"Invalid request or cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents/{id}":{"get":{"operationId":"getIncident","description":"Get an authorized incident without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incident.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Incident not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens":{"get":{"operationId":"listMachinesJoinTokens","x-speakeasy-group":"machines","x-speakeasy-name-override":"listJoinTokens","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Join tokens for a Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMachinesJoinTokensResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"createJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Newly minted Machines join token. Existing tokens keep working; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/rotate":{"post":{"operationId":"rotateMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"rotateJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Rotated Machines join token. Revokes all existing tokens, then mints a new one; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/{tokenId}":{"delete":{"operationId":"revokeMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"revokeJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"tokenId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines join token revocation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}/drain":{"delete":{"operationId":"cancelMachinesMachineDrain","x-speakeasy-group":"machines","x-speakeasy-name-override":"cancelMachineDrain","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines drain cancellation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelMachinesMachineDrainResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"drainMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"drainMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineRequest"}}}},"responses":{"200":{"description":"Machines drain request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}":{"delete":{"operationId":"removeMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"removeMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines remove request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoveMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/bootstrap":{"post":{"operationId":"bootstrapCommands","description":"Resolve a deployment's current manager and mint a five-minute command capability. Sender tokens can dispatch and observe commands only for this deployment. Receiver tokens can lease and complete commands only for the resolved Container or Daemon target.","x-speakeasy-group":"commands","x-speakeasy-name-override":"bootstrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapRequest"}}}},"responses":{"200":{"description":"Manager connection details and a short-lived command capability.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapResponse"}}}},"400":{"description":"Invalid request or deployment state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot operate this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, manager, or receiver target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The selected resource cannot run an external receiver.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands":{"get":{"operationId":"listCommands","description":"Retrieve commands. Use for dashboard analytics and command history.","x-speakeasy-group":"commands","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Filter by command state"},"required":false,"description":"Filter by command state","name":"state","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Filter by command name"},"required":false,"description":"Filter by command name","name":"name","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search commands by name"},"required":false,"description":"Search commands by name","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created after this date (ISO 8601)"},"required":false,"description":"Filter commands created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created before this date (ISO 8601)"},"required":false,"description":"Filter commands created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deployment","project"]},"description":"Optional fields to include: deployment, project"},"required":false,"description":"Optional fields to include: deployment, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved commands.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/CommandListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createCommand","description":"Create command metadata. Called by manager when processing commands. Returns project info for routing decisions.","x-speakeasy-group":"commands","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandRequest"}}}},"responses":{"201":{"description":"Command created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandResponse"}}}},"400":{"description":"Deployment is not ready or has no assigned manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The operation access request is no longer approved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The deployment manager is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/names":{"get":{"operationId":"listCommandNames","description":"List distinct command names. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listNames","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search command names (prefix match)"},"required":false,"description":"Search command names (prefix match)","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct command names.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandNamesResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/deployments":{"get":{"operationId":"listCommandDeployments","description":"List distinct deployments that have commands, including deployment group info. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search deployment or deployment group names"},"required":false,"description":"Search deployment or deployment group names","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct deployments that have commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandDeploymentsResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/target":{"get":{"operationId":"resolveCommandTarget","description":"Resolve which resource a command for this deployment would be addressed to, and how it would be delivered. Fails when the deployment has no command-capable resources, or more than one and no explicit target was named.","x-speakeasy-group":"commands","x-speakeasy-name-override":"resolveTarget","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment to resolve the target for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Deployment to resolve the target for","name":"deploymentId","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Explicit resource id to resolve; must be a command-capable resource"},"required":false,"description":"Explicit resource id to resolve; must be a command-capable resource","name":"target","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":255,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead."},"required":false,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead.","name":"command","in":"query"}],"responses":{"200":{"description":"Resolved command target.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolvedCommandTarget"}}}},"404":{"description":"Deployment or target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}":{"patch":{"operationId":"updateCommand","description":"Update command state. Called by manager when command is dispatched or completes.","x-speakeasy-group":"commands","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateCommandRequest"}}}},"responses":{"200":{"description":"Command updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getCommand","description":"Retrieve a command by ID.","x-speakeasy-group":"commands","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["true"],"description":"Explicitly confirm access to an operation result marked sensitive."},"required":false,"description":"Explicitly confirm access to an operation result marked sensitive.","name":"confirmSensitiveOutput","in":"query"}],"responses":{"200":{"description":"Retrieved command.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid operation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/dispatch":{"post":{"operationId":"dispatchCommand","description":"Atomically mark a command DISPATCHED unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"dispatch","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandRequest"}}}},"responses":{"200":{"description":"Dispatch attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/complete":{"post":{"operationId":"completeCommand","description":"Atomically transition a command to a terminal state (SUCCEEDED, FAILED, or EXPIRED) unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"complete","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandRequest"}}}},"responses":{"200":{"description":"Completion attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/increment-attempt":{"post":{"operationId":"incrementCommandAttempt","description":"Atomically increment the command's attempt counter and return the new value.","x-speakeasy-group":"commands","x-speakeasy-name-override":"incrementAttempt","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Attempt incremented.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncrementCommandAttemptResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions":{"get":{"operationId":"listDebugSessions","description":"Retrieve debug sessions for dashboard audit. Filters: project, deployment, state, mode.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Filter by session state"}]},"required":false,"description":"Filter by session state","name":"state","in":"query"},{"schema":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model (push/pull). Joins against the parent deployment."},"required":false,"description":"Filter by deployment model (push/pull). Joins against the parent deployment.","name":"mode","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Filter by cloud provider. Joins against the parent deployment."},"required":false,"description":"Filter by cloud provider. Joins against the parent deployment.","name":"provider","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Paginated debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSessionListResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDebugSession","description":"Create a debug-session audit row. Called by the manager when a pull or push debug tunnel is opened. Workspace + project derived from deployment.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDebugSessionRequest"}}}},"responses":{"201":{"description":"Debug session created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Deployment or access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions/{id}":{"patch":{"operationId":"updateDebugSession","description":"Update debug-session state. Called by manager on tunnel attach, close, or deadline expiry.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDebugSessionRequest"}}}},"responses":{"200":{"description":"Debug session updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Debug session not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDebugSession","description":"Retrieve a debug session by ID.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved debug session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info":{"get":{"operationId":"getDeploymentInfo","description":"Get deployment information for the deployment portal. Accepts both deployment-scoped and deployment-group-scoped API keys. Returns project information, package status/outputs, and either deployment or deployment group details depending on the token type. Poll this endpoint to check if packages are ready.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":false,"description":"Represents the target cloud platform.","name":"platform","in":"query"},{"schema":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":false,"name":"setupItem","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"updateOperationId","in":"query"}],"responses":{"200":{"description":"Deployment information retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInfo"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-scoped or deployment-group-scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/compute-plan":{"post":{"operationId":"planDeploymentCompute","description":"Plan deployment compute for the active release before stack preparation. The response contains recommended machine and scale choices for cloud compute pools.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"planCompute","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Compute plan returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentComputePlan"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/prepare-stack":{"post":{"operationId":"prepareDeploymentStack","description":"Prepare the active release stack for a deployment portal setup session. The response contains the generated stack shape plus setup compatibility metadata.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"prepareStack","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"saveForSetup":{"type":"boolean","description":"Persist validated choices for the exact blocked update; does not apply cloud changes."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Prepared stack returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PreparedDeploymentStack"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/install-url":{"post":{"operationId":"slackIntegrationInstallUrl","description":"Generate the Slack OAuth consent URL for this workspace.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"installUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"OAuth URL the dashboard should redirect the user to.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackInstallUrlResponse"}}}},"500":{"description":"Server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/status":{"get":{"operationId":"slackIntegrationStatus","description":"Return the Slack install for this workspace (if any).","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"status","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackIntegrationStatus"}}}}}}},"/v1/integrations/slack/channels":{"get":{"operationId":"slackIntegrationChannels","description":"List public Slack channels for this workspace's install. Used by the dashboard's notification-channel picker.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"listChannels","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Public channels.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackChannelsResponse"}}}},"400":{"description":"Workspace not connected to Slack.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/notification-channel":{"put":{"operationId":"slackIntegrationSetNotificationChannel","description":"Configure which Slack channel receives ai-agent monitor reports.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"setNotificationChannel","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelRequest"}}}},"responses":{"200":{"description":"Channel saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelResponse"}}}},"400":{"description":"Not connected, or join failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/installation":{"delete":{"operationId":"slackIntegrationUninstall","description":"Uninstall the Slack integration for this workspace. Revokes the bot token at Slack and deletes the row.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"uninstall","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Uninstalled."}}}},"/v1/agent-sessions":{"get":{"operationId":"listAgentSessions","description":"List ai-agent monitor sessions for this workspace, or for one project. Newest first, capped at 50.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},{"description":"Only sessions bound to this project. Omit to list the whole workspace."}]},"required":false,"description":"Only sessions bound to this project. Omit to list the whole workspace.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionListResponse"}}}}}}},"/v1/agent-sessions/{id}":{"get":{"operationId":"getAgentSession","description":"Retrieve one ai-agent monitor session by id.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionDetail"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/events":{"get":{"operationId":"listAgentSessionEvents","description":"Incrementally read a session's event log (steps, tool calls, report deltas, approvals, status transitions). Pass the previous response's `latestSeq` as `after` to fetch only new events.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"events","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","nullable":true,"minimum":0,"default":0},"required":false,"name":"after","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":500,"default":200},"required":false,"name":"limit","in":"query"}],"responses":{"200":{"description":"Events after the cursor, oldest first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionEventsResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/stop":{"post":{"operationId":"stopAgentSession","description":"Stop (cancel) a running or queued ai-agent monitor session. Proxies to the ai-agent service, minting a fresh CLI session for the caller so the ai-agent's own auth applies. Idempotent — stopping an already-terminal session is a 200 no-op.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"stop","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Already terminal / no-op.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"202":{"description":"Cancel accepted; session stopped.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"AI agent service is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins":{"get":{"operationId":"listOperationsPlugins","description":"List available operations plugins (builtin + custom) for a project, with their operations and risk tiers.","x-speakeasy-group":"operations","x-speakeasy-name-override":"listPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The operations plugin catalog.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListOperationsPluginsResponse"}}}},"409":{"description":"A persisted custom plugin has invalid metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"publishOperationsPlugin","description":"Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"publishPlugin","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginRequest"}}}},"responses":{"201":{"description":"The plugin was published, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginResponse"}}}},"400":{"description":"Invalid metadata, or no bundle was uploaded for this name/version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A plugin with this name is already published at this version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/builtin/enabled":{"put":{"operationId":"setBuiltinOperationsPlugins","description":"Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setBuiltinPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsRequest"}}}},"responses":{"200":{"description":"The enabled built-in plugin set was replaced, with the cloud permission delta.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsResponse"}}}},"400":{"description":"One or more plugin names are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/upload-url":{"post":{"operationId":"createOperationsBundleUploadUrl","description":"Get a presigned S3 URL to upload a custom operations plugin bundle ZIP. Upload the ZIP with a PUT to the returned url (sending the given Content-Type), then call POST /plugins to register it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"createBundleUploadUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlRequest"}}}},"responses":{"200":{"description":"A presigned upload URL for the bundle ZIP.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlResponse"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Bundle storage is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/{name}/enabled":{"patch":{"operationId":"setOperationsPluginEnabled","description":"Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setPluginEnabled","parameters":[{"schema":{"type":"string","description":"Plugin name."},"required":true,"description":"Plugin name.","name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledRequest"}}}},"responses":{"200":{"description":"The plugin's enabled state was updated, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledResponse"}}}},"404":{"description":"No such plugin for this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The plugin metadata is invalid for the requested enabled state, or the permission delta differs from `expectedPermissionDiff`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/policy":{"get":{"operationId":"getOperationsPolicy","description":"Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"getPolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The approval policy rules and default.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateOperationsPolicy","description":"Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"updatePolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateOperationsPolicyRequest"}}}},"responses":{"200":{"description":"The updated approval policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/invoke":{"post":{"operationId":"invokeOperation","description":"Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"invoke","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationRequest"}}}},"responses":{"200":{"description":"The operation was dispatched or queued for approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationResponse"}}}},"400":{"description":"Parameters do not satisfy the operation's published input schema.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not create commands for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Plugin or operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Plugin is disabled or has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/verify-check":{"post":{"operationId":"verifyOperationCheck","description":"One verification poll cycle for an original operation command. Loads that command's authoritative stored result and dispatch-time verification contract, dispatches the frozen read-only poll operation once, and evaluates its frozen success condition. Callers poll this repeatedly per the returned policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"verifyCheck","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckRequest"}}}},"responses":{"200":{"description":"The outcome of this single verification poll cycle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckResponse"}}}},"400":{"description":"The verification command cannot be dispatched to the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not dispatch verification commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or original command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid verification command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests":{"post":{"operationId":"createAccessRequest","description":"Create an access request — either plan-backed (an ai-agent investigation's exact commands) or plan-less (a CLI-originated exact operation or wildcard pattern, resolved and frozen here). Plan-backed requests await the engineer gate (status `pending-approval`); plan-less requests are queued immediately since the requester is asking for their own access (status `queued`).","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAccessRequest"}}}},"responses":{"201":{"description":"The created access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"400":{"description":"Invalid create payload or requested expiry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The requester cannot access the target deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or remediation plan not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Replay key payload conflicts or the remediation plan already has a request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listAccessRequests","description":"List a project's access requests, newest first.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AccessRequestStatus"},"description":"Filter by status."},"required":false,"description":"Filter by status.","name":"status","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Only requests proposed by this investigation's remediation plan."},"required":false,"description":"Only requests proposed by this investigation's remediation plan.","name":"agentSessionId","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"The project's access requests.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/queue":{"post":{"operationId":"queueAccessRequest","description":"Engineer gate — approve a pending access request, queuing it for the operator to materialize. Records who queued it.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The queued access request, with the customer approve command.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"kubectlApprove":{"type":"string","nullable":true}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","kubectlApprove"]}}}},"400":{"description":"The requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not pending approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/approve":{"post":{"operationId":"approveAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may approve a queued access request. Actor identity comes from authentication; method/source are audit context only.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}},"approvedForMinutes":{"type":"integer","minimum":0,"exclusiveMinimum":true}},"required":["method"]}}}},"responses":{"200":{"description":"The approved access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"approvalMethod":{"$ref":"#/components/schemas/AccessRequestApprovalMethod"}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","approvalMethod"]}}}},"400":{"description":"The approval window or requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued, or its requester identity is unknown and a new request is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/deny":{"post":{"operationId":"denyAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may reject a queued access request. Actor identity comes from authentication.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}}},"required":["method"]}}}},"responses":{"200":{"description":"The rejected access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued (already approved, denied, expired, or still pending the engineer gate).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/coordinates":{"get":{"operationId":"getAccessRequestCoordinates","description":"The customer's kubectl approve command for a queued access request, or null until the operator has materialized the grant CR and reported its coordinates. Polled by the Slack handler to update the access-plan card.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The approve command (or null) and current status.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"kubectlApprove":{"type":"string","nullable":true}},"required":["status","kubectlApprove"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/pending":{"get":{"operationId":"listPendingAccessRequests","description":"Operator-facing: queued access requests whose requester deadline has not elapsed, for the access-request sync loop to materialize as grant CRs.","x-speakeasy-ignore":true,"parameters":[{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Queued access requests for the deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"requests":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"requestedExpiresAt":{"type":"string","nullable":true}},"required":["id","title","reason","commands","debugGrant","requestedExpiresAt"]}},"revokedRequestIds":{"type":"array","items":{"type":"string"},"description":"Requests revoked in the last six hours, or revoked while their approved window is still open, so the operator can mark their grant CRs REVOKED. Older operators ignore this field."}},"required":["requests","revokedRequestIds"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/materialized":{"post":{"operationId":"reportMaterializedAccessRequests","description":"Operator-facing: record the namespace + CRD plural the operator materialized the grant CRs in, so the control plane can render the customer's exact kubectl approve command.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"requestIds":{"type":"array","items":{"type":"string"}},"namespace":{"type":"string","minLength":1},"resourcePlural":{"type":"string","minLength":1}},"required":["deploymentId","requestIds","namespace","resourcePlural"]}}}},"responses":{"200":{"description":"Number of requests updated with CR coordinates.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/approvals":{"post":{"operationId":"reportAccessApprovals","description":"Operator-facing: record the customer's approval windows reported back by the sync loop. Retires requester-expired requests and skips stale windows without blocking live approvals. Moves live requests to customer-approved and resumes the investigation to dispatch commands.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"approvals":{"type":"array","items":{"type":"object","properties":{"requestId":{"type":"string"},"approvedUntil":{"type":"string"}},"required":["requestId","approvedUntil"]}}},"required":["deploymentId","approvals"]}}}},"responses":{"200":{"description":"Number of approvals recorded.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"400":{"description":"Invalid approval report payload.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/live-debug-grant":{"get":{"operationId":"getLiveDebugGrant","description":"Find an approved, unexpired access request the caller created whose debug grant matches this deployment and tool (and, when given, namespace/cloudScope). Returns the most recently approved match, or 404 when none is live. Used to reuse an existing grant instead of proposing a new access request. Only the requester's own grants match: a debug session must present a grant its caller requested, so another principal's grant is never returned here.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"The deployment to check for a live debug grant.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"The deployment to check for a live debug grant.","name":"deploymentId","in":"query"},{"schema":{"$ref":"#/components/schemas/DebugGrantTool"},"required":true,"name":"debugTool","in":"query"},{"schema":{"type":"string","description":"Match a `kubectl` grant scoped to this namespace exactly."},"required":false,"description":"Match a `kubectl` grant scoped to this namespace exactly.","name":"debugNamespace","in":"query"},{"schema":{"type":"string","description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly."},"required":false,"description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly.","name":"debugCloudScope","in":"query"}],"responses":{"200":{"description":"A live access request with a matching debug grant.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"No approved, unexpired access request matches.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/activity":{"get":{"operationId":"getAccessRequestActivity","description":"The operation commands and debug sessions an access request authorized, with each command's verification outcome. Authorized like getAccessRequest.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The request's operations and debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRequestActivity"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/revoke":{"post":{"operationId":"revokeAccessRequest","description":"Revoke a pending, queued or customer-approved access request. The principal that created the request, or any workspace member or administrator who can read its project, may revoke it. Commands the grant authorized that have not been dispatched are failed; dispatched commands finish. Linked debug sessions are stopped and refuse their next request. Revoking an already revoked request returns it unchanged.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeAccessRequest"}}}},"responses":{"200":{"description":"The revoked access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"The caller may read but not revoke this request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The request has already expired or been rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}":{"get":{"operationId":"getAccessRequest","description":"Get an access request by id.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/list":{"post":{"operationId":"syncList","description":"List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.","x-speakeasy-group":"sync","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListRequest"}}}},"responses":{"200":{"description":"Full deployment records returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/context":{"post":{"operationId":"syncContext","description":"Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.","x-speakeasy-group":"sync","x-speakeasy-name-override":"context","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncContextRequest"}}}},"responses":{"200":{"description":"Computed deployment context returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"}}}},"404":{"description":"Deployment not found or not assigned to this manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to build deployment context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/acquire":{"post":{"operationId":"syncAcquire","description":"Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.","x-speakeasy-group":"sync","x-speakeasy-name-override":"acquire","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireRequest"}}}},"responses":{"200":{"description":"Deployments acquired successfully (empty arrays if none available). Failures indicate deployments that were locked but failed during context building - their locks have been released.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/reconcile":{"post":{"operationId":"syncReconcile","description":"Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.","x-speakeasy-group":"sync","x-speakeasy-name-override":"reconcile","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileRequest"}}}},"responses":{"200":{"description":"State reconciled successfully. If target is present, continue deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment locked (pull) or session mismatch (push).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/renew":{"post":{"operationId":"syncRenew","x-speakeasy-group":"sync","x-speakeasy-name-override":"renew","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncRenewRequest"}}}},"responses":{"200":{"description":"Renewal processed. Inspect `leases` for per-deployment outcomes; a lost lease is reported there rather than failing the whole batch.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when every requested deployment was renewed."},"leases":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"renewed":{"type":"boolean","description":"False when this session no longer holds a live lease."},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["deploymentId","renewed","leaseExpiresAt"]},"description":"Per-deployment renewal outcome."}},"required":["success","leases"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The session no longer owns the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/release":{"post":{"operationId":"syncRelease","description":"Release a deployment lock. Must be called after processing an acquired deployment, even if processing failed. This is critical to avoid deadlocks.","x-speakeasy-group":"sync","x-speakeasy-name-override":"release","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReleaseRequest"}}}},"responses":{"200":{"description":"Lock released successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when released or the exact terminal receipt was acknowledged. False when completion could not be established."}},"required":["success"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources":{"get":{"operationId":"listInventory","x-speakeasy-group":"resources","x-speakeasy-name-override":"listInventory","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Unified managed and observed resource inventory rows.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"},"source":{"type":"string","enum":["managed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt","source","deploymentId","deploymentName"]},{"type":"object","properties":{"source":{"type":"string","enum":["observed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"rawKind":{"type":"string"},"alienResourceId":{"type":"string","nullable":true},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["source","deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","name","rawKind","alienResourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}":{"get":{"operationId":"listResourceOverview","x-speakeasy-group":"resources","x-speakeasy-name-override":"listOverview","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Compute resource overview rows from latest heartbeats.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/{resourceId}/deployments":{"get":{"operationId":"listResourceDeployments","description":"List deployments where the selected resource is installed.","x-speakeasy-group":"resources","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Deployments where the resource is installed.","content":{"application/json":{"schema":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"deployments":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt"]}}},"required":["resourceType","resourceId","deployments"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/deployments/{deploymentId}/{resourceId}":{"get":{"operationId":"getResourceDeploymentDetail","x-speakeasy-group":"resources","x-speakeasy-name-override":"getDeploymentDetail","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Latest heartbeat detail for one resource deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"deployment":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"},"desiredImage":{"type":"string","nullable":true}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt","desiredImage"]},"heartbeat":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"staleAt":{"type":"string","format":"date-time"},"platformStale":{"type":"boolean"},"heartbeat":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"raw":{"type":"array","items":{"nullable":true}}},"required":["status","deploymentId","resourceId","resourceType","backend","controllerPlatform","observedAt","staleAt","platformStale","heartbeat","raw"]},{"type":"object","properties":{"status":{"type":"string","enum":["missing"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"}},"required":["status","deploymentId","resourceId","resourceType"]}]}},"required":["deployment","heartbeat"]}}}},"404":{"description":"Deployment or resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys":{"get":{"operationId":"listAwsVirtualKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"AWS Virtual Keys in a project","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKeys":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}},"required":["virtualKeys"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAwsVirtualKey","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"selector":{"oneOf":[{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false}]},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128},"alias":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"description":{"type":"string","nullable":true,"maxLength":8192},"deletionWindowDays":{"type":"integer","minimum":7,"maximum":30,"default":30},"tags":{"type":"object","additionalProperties":{"type":"string","maxLength":256},"default":{}}},"required":["selector","awsAccountId","awsRegion","idempotencyKey"]}}}},"responses":{"200":{"description":"Created or resumed Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Enterprise Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Gateway unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/rotate-credential":{"post":{"operationId":"rotateAwsVirtualKeyCredential","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"generation":{"type":"integer","minimum":2}},"required":["generation"]}}}},"responses":{"200":{"description":"The resumable XKS proxy credential rotation bundle","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot begin rotation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/restore":{"post":{"operationId":"restoreAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key awaiting a successful AWS XKS canary after restore","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot be restored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/finalize-deletion":{"post":{"operationId":"finalizeAwsVirtualKeyDeletion","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key whose final AWS KMS deletion was observed","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key deletion cannot be finalized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/decommission":{"post":{"operationId":"decommissionAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"},"deletionScheduledAt":{"type":"string","format":"date-time"}},"required":["kmsKeyArn","deletionScheduledAt"]}}}},"responses":{"200":{"description":"Virtual Key with AWS deletion scheduled","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"AWS key does not match","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}":{"get":{"operationId":"getAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"responses":{"200":{"description":"AWS Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/continue":{"post":{"operationId":"continueAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"customKeyStoreId":{"type":"string","pattern":"^cks-[A-Za-z0-9]+$"},"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["customKeyStoreId","kmsKeyArn"]}}}},"responses":{"200":{"description":"Updated AWS setup facts","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Setup facts conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resolve":{"get":{"operationId":"resolve","tags":["resolve"],"summary":"Resolve manager for a project and platform","description":"Returns the manager URL for a given project and platform. The project can be provided as a query parameter, or derived from the token's scope (project-scoped, deployment-group-scoped, or deployment-scoped tokens carry an implicit project). This is the single entry point for all CLI tools to discover which manager to talk to.","x-speakeasy-group":"resolve","x-speakeasy-name-override":"resolve","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform to resolve the manager for"},"required":true,"description":"Target platform to resolve the manager for","name":"platform","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope)."},"required":false,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope).","name":"project","in":"query"}],"responses":{"200":{"description":"Manager resolved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveResponse"}}}},"400":{"description":"Missing required project parameter for this token type.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found or no manager available for platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Manager not ready yet (no URL reported). Retry after a delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/cloud-regions":{"get":{"operationId":"getCloudRegions","description":"Get cloud regions supported by this Alien environment.","x-speakeasy-group":"cloudRegions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Supported cloud regions retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudRegionsResponse"}}}}}}},"/v1/billing/audit-log":{"get":{"operationId":"listBillingAuditLog","description":"List billing activity entries for the current workspace.","x-speakeasy-group":"billing","x-speakeasy-name-override":"listAuditLog","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"number","minimum":1,"maximum":200,"default":50},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor: id from the previous page."},"required":false,"description":"Cursor: id from the previous page.","name":"before","in":"query"}],"responses":{"200":{"description":"Audit-log rows newest-first.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/BillingAuditLogRow"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"]}}}}}}},"/v1/billing/entitlements":{"get":{"operationId":"getWorkspaceBillingEntitlements","description":"Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.","x-speakeasy-group":"billing","x-speakeasy-name-override":"getEntitlements","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace billing entitlements.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceBillingEntitlements"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/gateways/{gateway}/overview":{"get":{"operationId":"getWorkspaceGatewayOverview","description":"Get compact cross-Project setup and customer status for a workspace Gateway.","x-speakeasy-group":"gateways","x-speakeasy-name-override":"getWorkspaceOverview","parameters":[{"schema":{"$ref":"#/components/schemas/GatewayKind"},"required":true,"description":"Alien Gateway a customer deployment runs","name":"gateway","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace Gateway overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceGatewayOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}}}}
+{"openapi":"3.0.0","info":{"title":"Alien API","version":"1.0.0","contact":{"name":"Alien Team","url":"https://alien.dev"}},"servers":[{"url":"https://api.alien.dev","description":"Alien API - Production"}],"security":[{"apiKey":[]}],"components":{"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","bearerFormat":"API key","description":"API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys"}},"schemas":{"WorkspaceInvitationPreview":{"type":"object","properties":{"kind":{"type":"string","enum":["email","link"]},"workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name","logoUrl"]},"inviter":{"type":"object","nullable":true,"properties":{"name":{"type":"string"},"image":{"type":"string","nullable":true,"format":"uri"}},"required":["name","image"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"state":{"type":"string","enum":["active","accepted","expired","revoked"]},"emailHint":{"type":"string","nullable":true}},"required":["kind","workspace","inviter","role","expiresAt","state","emailHint"],"additionalProperties":false},"WorkspaceRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"Role for workspace-scoped service accounts","example":"workspace.member"},"APIError":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"requestId":{"type":"string","description":"Request ID echoed in the x-request-id response header and server logs."}},"required":["code","message","internal"]},"Membership":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"role":{"type":"string"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","logoUrl","role","createdAt"],"additionalProperties":false},"UserProfile":{"type":"object","properties":{"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","description":"User's email address"},"name":{"type":"string","description":"User's display name"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"},"githubUsername":{"type":"string","nullable":true,"description":"Linked GitHub username"},"cliConnected":{"type":"boolean","description":"Whether this user has ever authenticated a request from the Alien CLI. Latched on first CLI request, never cleared."},"company":{"type":"string","nullable":true,"description":"Company name collected during profile setup."},"acquisitionSource":{"type":"string","nullable":true,"enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other",null],"description":"How the user heard about Alien."},"acquisitionSourceDetail":{"type":"string","nullable":true,"description":"Additional acquisition source detail when the source is other."},"useCases":{"type":"string","nullable":true,"description":"What the user is hoping to use Alien for."},"profileSetupCompletedAt":{"type":"string","format":"date-time","nullable":true,"description":"When the user completed the required profile setup dialog."},"profileSetupVersion":{"type":"integer","nullable":true,"description":"Version of the required profile setup dialog the user completed."}},"required":["id","email","name","image","githubUsername","cliConnected","company","acquisitionSource","acquisitionSourceDetail","useCases","profileSetupCompletedAt","profileSetupVersion"],"additionalProperties":false},"UserProfileSetupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"},"company":{"type":"string","minLength":1,"maxLength":120,"description":"Company name"},"acquisitionSource":{"type":"string","enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other"],"description":"How the user heard about Alien"},"acquisitionSourceDetail":{"type":"string","minLength":1,"maxLength":200,"description":"Required when acquisitionSource is other"},"useCases":{"type":"string","maxLength":2000,"description":"What the user is hoping to use Alien for"}},"required":["name","company","acquisitionSource"],"additionalProperties":false},"GitNamespace":{"type":"object","properties":{"id":{"type":"number","nullable":true},"name":{"type":"string"},"slug":{"type":"string"},"installationId":{"type":"number","nullable":true},"type":{"type":"string","enum":["team","user"]},"provider":{"type":"string","enum":["github"]},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","slug","installationId","type","provider","createdAt"],"additionalProperties":false},"GitRepository":{"type":"object","properties":{"name":{"type":"string"},"private":{"type":"boolean"},"defaultBranch":{"type":"string"},"pushedAt":{"type":"string","format":"date-time"}},"required":["name","private","defaultBranch"],"additionalProperties":false},"AcceptWorkspaceInvitationResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["joined","already-member"]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"workspaceName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["outcome","workspaceId","workspaceName","role"],"additionalProperties":false},"Subject":{"oneOf":[{"$ref":"#/components/schemas/UserSubject"},{"$ref":"#/components/schemas/ServiceAccountSubject"}],"discriminator":{"propertyName":"kind","mapping":{"user":"#/components/schemas/UserSubject","serviceAccount":"#/components/schemas/ServiceAccountSubject"}},"description":"Authenticated principal that can be either a user (with workspace-scoped permissions) or a service account (with configurable scope and role)"},"UserSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["user"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","format":"email","description":"User's email address"},"workspaceId":{"type":"string","description":"ID of the workspace the user is authenticated within"},"workspaceName":{"type":"string","description":"Name of the workspace the user is authenticated within"},"role":{"$ref":"#/components/schemas/UserRole"}},"required":["kind","id","email","workspaceId","role"],"description":"Authenticated user subject with workspace-scoped permissions"},"UserRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"User's role within the workspace","example":"workspace.member"},"ServiceAccountSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["serviceAccount"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique service account identifier (API key ID)"},"workspaceId":{"type":"string","description":"ID of the workspace the service account belongs to"},"workspaceName":{"type":"string","description":"Name of the workspace the service account belongs to"},"scope":{"$ref":"#/components/schemas/SubjectScope"},"role":{"$ref":"#/components/schemas/Role"}},"required":["kind","id","workspaceId","scope","role"],"description":"Authenticated service account subject with scoped permissions (workspace, project, or deployment level)"},"SubjectScope":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["workspace"],"description":"Workspace-scoped access"}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["project"],"description":"Project-scoped access"},"projectId":{"type":"string","description":"ID of the specific project this scope applies to"}},"required":["type","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment"],"description":"Deployment-scoped access"},"deploymentId":{"type":"string","description":"ID of the specific deployment this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"}},"required":["type","deploymentId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"],"description":"Deployment group-scoped access"},"deploymentGroupId":{"type":"string","description":"ID of the specific deployment group this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"}},"required":["type","deploymentGroupId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["manager"],"description":"Manager-scoped access"},"managerId":{"type":"string","description":"ID of the specific manager this scope applies to"}},"required":["type","managerId"]}],"description":"Authorization scope defining what resources this service account can access"},"Role":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"$ref":"#/components/schemas/ProjectRole"},{"$ref":"#/components/schemas/DeploymentRole"},{"$ref":"#/components/schemas/DeploymentGroupRole"},{"$ref":"#/components/schemas/ManagerRole"}],"description":"Role defining what actions this service account can perform within its scope","example":"workspace.member"},"ProjectRole":{"type":"string","enum":["project.viewer","project.developer","project.encryption","project.ai-gateway","project.sandbox-gateway","project.remote-bindings"],"description":"Role for project-scoped service accounts","example":"project.developer"},"DeploymentRole":{"type":"string","enum":["deployment.viewer","deployment.manager","deployment.dynamic-container-manager","deployment.telemetry-writer"],"description":"Role for deployment-scoped service accounts","example":"deployment.manager"},"DeploymentGroupRole":{"type":"string","enum":["deployment-group.deployer"],"description":"Role for deployment group-scoped service accounts","example":"deployment-group.deployer"},"ManagerRole":{"type":"string","enum":["manager.runtime"],"description":"Role for manager-scoped service accounts","example":"manager.runtime"},"ProjectIDOrNamePathParam":{"type":"string","maxLength":100,"description":"Project ID or name."},"Workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name.","example":"my-workspace"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","createdAt"],"additionalProperties":false},"WorkspaceMember":{"type":"object","properties":{"userId":{"type":"string"},"email":{"type":"string"},"name":{"type":"string"},"image":{"type":"string","nullable":true},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"joinedAt":{"type":"string","format":"date-time"}},"required":["userId","email","name","image","role","joinedAt"],"additionalProperties":false},"AgentSettings":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"enabled":{"type":"boolean","description":"Workspace on/off switch for the ai-agent. When `false`, incoming triggers (release/deployment monitoring and Slack-invoked sessions) are rejected before any session runs. Defaults to `true`."},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","enabled","createdAt","updatedAt"],"additionalProperties":false},"UpdateWorkspaceSettingsRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Turn the ai-agent on (`true`) or off (`false`) for this workspace."}}},"WorkspaceInvitation":{"type":"object","properties":{"id":{"type":"string","pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"},"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"status":{"type":"string","enum":["pending","accepted","revoked","expired"]},"deliveryStatus":{"type":"string","enum":["pending","sent","failed"]},"expiresAt":{"type":"string","format":"date-time"},"lastSentAt":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","email","role","status","deliveryStatus","expiresAt","lastSentAt","createdAt","inviteUrl"],"additionalProperties":false},"WorkspaceInviteLink":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"wil_[0-9a-zA-Z]{40}$","description":"Unique identifier for the workspace invite link.","example":"wil_RgcthDSZ37rmFLekuItpFS7btjXoYwou1gE4"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"useCount":{"type":"integer","minimum":0},"lastUsedAt":{"type":"string","format":"date-time","nullable":true},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","role","expiresAt","createdAt","useCount","lastUsedAt","inviteUrl"],"additionalProperties":false},"ProjectListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"deploymentCount":{"type":"number"},"latestRelease":{"$ref":"#/components/schemas/ProjectReleaseInfo"}}}]},"DeploymentPortalAppearancePreset":{"type":"string","enum":["clean","technical","enterprise","playful","minimal"],"default":"clean","description":"Curated visual style for the deployment portal."},"DeploymentPortalAccentColor":{"type":"string","enum":["blue","purple","green","orange","pink","slate"],"default":"blue","description":"Accent color used for highlights and primary actions."},"DeploymentPortalDensity":{"type":"string","enum":["comfortable","compact"],"default":"comfortable","description":"Layout density for portal content."},"ProjectReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","gitMetadata","createdAt"]},"GitMetadata":{"type":"object","nullable":true,"properties":{"commitSha":{"type":"string","nullable":true,"pattern":"^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$","description":"The hash of the commit","example":"dc36199b2234c6586ebe05ec94078a895c707e29"},"commitMessage":{"type":"string","nullable":true,"maxLength":1024,"description":"The commit message","example":"add method to measure Interaction to Next Paint (INP) (#36490)"},"commitRef":{"type":"string","nullable":true,"maxLength":256,"description":"The branch or tag on which the commit was made","example":"main"},"commitDate":{"type":"string","nullable":true,"format":"date-time","description":"The date and time when the commit was created","example":"2026-03-16T12:00:00Z"},"dirty":{"type":"boolean","nullable":true,"description":"Whether or not there have been modifications to the working tree since the latest commit","example":true},"remoteUrl":{"type":"string","nullable":true,"maxLength":2048,"description":"The git repository's remote origin url","example":"https://github.com/alienplatform/alien"},"commitAuthorName":{"type":"string","nullable":true,"maxLength":256,"description":"The name of the author of the commit (from git config)","example":"John Doe"},"commitAuthorEmail":{"type":"string","nullable":true,"maxLength":256,"description":"The author identity recorded by Git. This is not guaranteed to be an RFC-valid email address.","example":"john@example.com"},"commitAuthorLogin":{"type":"string","nullable":true,"maxLength":256,"description":"The provider username of the commit author (e.g., GitHub login), resolved server-side from the commit email","example":"johndoe"},"commitAuthorAvatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"The avatar URL of the commit author, resolved server-side from the provider login","example":"https://github.com/johndoe.png"},"provider":{"$ref":"#/components/schemas/GitProvider"}}},"GitProvider":{"oneOf":[{"$ref":"#/components/schemas/GitHubProvider"},{"$ref":"#/components/schemas/GitLabProvider"},{"nullable":true}],"description":"Provider-specific repository information, resolved server-side from remoteUrl"},"GitHubProvider":{"type":"object","properties":{"type":{"type":"string","enum":["github"]},"org":{"type":"string","maxLength":256,"description":"Repository owner (user or organization)"},"repo":{"type":"string","maxLength":256,"description":"Repository name"}},"required":["type","org","repo"]},"GitLabProvider":{"type":"object","properties":{"type":{"type":"string","enum":["gitlab"]},"namespace":{"type":"string","maxLength":256,"description":"Group/project namespace"},"project":{"type":"string","maxLength":256,"description":"Project name"}},"required":["type","namespace","project"]},"Project":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"projectCapabilities":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"default":null,"required":["schemaVersion","capabilities"],"additionalProperties":false,"description":"Capabilities this Project may offer through setup links."},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","createdAt","workspaceId"]},"ProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","redirectUris"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"hasClientSecret":{"type":"boolean","enum":[true]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","clientId","hasClientSecret","redirectUris"]}]},"GcpOAuthClientId":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[a-zA-Z0-9_-]+-[a-zA-Z0-9_-]+\\.apps\\.googleusercontent\\.com$","description":"Google OAuth web client ID.","example":"1234567890-abc123.apps.googleusercontent.com"},"UpdateProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId"]}]},"GcpOAuthClientSecret":{"type":"string","minLength":1,"maxLength":512,"description":"Google OAuth web client secret. Write-only; never returned by the API.","example":"GOCSPX-example"},"UpdateProject":{"type":"object","properties":{"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"packagesConfigPatch":{"type":"object","properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"additionalProperties":false},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"additionalProperties":false},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"additionalProperties":false},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","nullable":true,"properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"additionalProperties":false}},"additionalProperties":false}},"additionalProperties":false}}},"DeploymentPortalDomainResponse":{"type":"object","properties":{"deploymentPortalEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"},"packageEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["deploymentPortalEndpoint","packageEndpoint"]},"DomainEndpoint":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dend_[0-9a-z]{28}$","description":"Unique identifier for the domain endpoint.","example":"dend_1bb6gdvm1bs74acqkjstcgv"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domainId":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"kind":{"$ref":"#/components/schemas/DomainEndpointKind"},"owner":{"$ref":"#/components/schemas/DomainEndpointOwner"},"hostname":{"type":"string","minLength":1,"maxLength":253},"status":{"$ref":"#/components/schemas/DomainEndpointStatus"},"provider":{"type":"string","nullable":true},"providerState":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"managedDnsRecords":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentPortalManagedDnsRecord"}},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"retryAttempts":{"type":"integer","minimum":0},"nextStepAfter":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","workspaceId","domainId","kind","owner","hostname","status","managedDnsRecords","retryAttempts","createdAt","updatedAt"]},"DomainEndpointKind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"DomainEndpointOwner":{"type":"object","properties":{"type":{"$ref":"#/components/schemas/DomainEndpointOwnerType"},"id":{"type":"string"}},"required":["type","id"]},"DomainEndpointOwnerType":{"type":"string","enum":["workspace","project","manager"]},"DomainEndpointStatus":{"type":"string","enum":["waiting_for_domain","provisioning","waiting_for_dns","waiting_for_health","active","failed","deleting"]},"DeploymentPortalManagedDnsRecord":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"value":{"type":"string"},"ttl":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true}},"required":["name","type","value"]},"DeploymentLinkSetupResponse":{"type":"object","properties":{"activeRelease":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","nullable":true},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true}},"required":["id","version","stack"]},"supportedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"setupItems":{"type":"array","items":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]}},"visiblePackageTypes":{"type":"array","items":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"}},"visibleSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"setupPackagesStatus":{"type":"string","enum":["preparing","ready","failed"],"description":"Whether at least one complete automated setup package is ready across all selected setup items."}},"required":["activeRelease","supportedPlatforms","setupItems","visiblePackageTypes","visibleSetupMethods","setupPackagesStatus"]},"StackByPlatform":{"type":"object","properties":{"aws":{"nullable":true},"gcp":{"nullable":true},"azure":{"nullable":true},"kubernetes":{"nullable":true},"machines":{"nullable":true},"local":{"nullable":true},"test":{"nullable":true}},"additionalProperties":false},"DeploymentSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform","helm","cli","manual"]},"ConfigureModelsRequest":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"minItems":1,"maxItems":100}},"required":["requirements"],"additionalProperties":false},"ProjectCapabilities":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"required":["schemaVersion","capabilities"],"additionalProperties":false},"AIProviderHeaders":{"type":"object","properties":{"providers":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"headers":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"},"value":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7E]*$"}},"required":["name","value"],"additionalProperties":false},"minItems":1,"maxItems":20}},"required":["provider","headers"],"additionalProperties":false},"maxItems":6}},"required":["providers"],"additionalProperties":false},"CapabilityMaterialization":{"type":"object","properties":{"projectCapabilities":{"$ref":"#/components/schemas/ProjectCapabilities"},"source":{"type":"object","properties":{"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"definitionVersion":{"type":"string"},"releaseId":{"type":"string"}},"required":["definitionId","definitionVersion","releaseId"]},"packages":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation","terraform","sandbox-bundle","gcp-sandbox-image"]},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"]}},"required":["type","status"]}}},"required":["projectCapabilities","source","packages"]},"ConfigureRemoteSandboxRequest":{"type":"object","properties":{"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800},"azureIdleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"additionalProperties":false},"SandboxBaseImageRepository":{"type":"object","properties":{"registryHost":{"type":"string","description":"Manager registry host to `docker login` to and push through."},"repository":{"type":"string","description":"This project's repository under that host."}},"required":["registryHost","repository"]},"ProjectCapabilityOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"configurationStatus":{"type":"string","enum":["valid","invalid"]},"hasAppRemoteSandbox":{"type":"boolean"},"summary":{"type":"object","properties":{"groups":{"type":"integer","minimum":0},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"keys":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"registry":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["groups","capabilities"]},"groups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"keys":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"buckets":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"registry":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"remoteSandbox":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["deploymentGroupId","name","externalId","createdAt","capabilities"]}}},"required":["generatedAt","configurationStatus","hasAppRemoteSandbox","summary","groups"]},"RemoteBindingsExternalAccessResponse":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1},"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","format":"uri"}},"required":["deploymentId","resourceId","accessToken","expiresIn","tokenType","managerUrl"]},"RemoteBindingsExternalAccessRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"capability":{"type":"string","enum":["storage","sandbox"]}},"required":["externalId","capability"],"additionalProperties":false},"RemoteOperatorInstallReceipt":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"renderedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","renderedAt"],"additionalProperties":false},"ObservedRemoteOperatorImageIdentity":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"observedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","observedAt"],"additionalProperties":false},"OperationsCatalogKubernetesPermissions":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsRule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false,"description":"Kubernetes RBAC required to execute this operation. Omitted by older servers and null when the operation declares none."},"OperationsCatalogKubernetesPermissionsRule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsVerb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"OperationsCatalogKubernetesPermissionsVerb":{"type":"string","enum":["get","list","watch","delete","patch"]},"RemoteOperatorPermissionPlugin":{"type":"object","properties":{"name":{"type":"string"},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"permissions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["aws","gcp"]},"kubernetesPermissions":{"type":"object","nullable":true,"properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"}},"required":["apiGroup","resource","verbs","reason"]}}},"required":["rules"]}},"required":["name","permissions"]}}},"required":["name","operations"]},"DeploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments allowed in this deployment group"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","externalId","projectId","workspaceId","createdAt"]},"CreateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments in this deployment group"}},"required":["name","project"]},"EnsureDeploymentGroupByNameRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["name","project"]},"EnsureDeploymentGroupByExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["externalId","name","project"]},"CreateSetupLinkResponse":{"allOf":[{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"},{"type":"object","properties":{"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroup"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"The persisted expiration date for the setup link"}},"required":["deploymentGroup","expiresAt"]}]},"CreateDeploymentGroupTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The API key token"},"deploymentLink":{"type":"string","description":"Formatted deployment link"}},"required":["token","deploymentLink"]},"CreateSetupLinkRequest":{"allOf":[{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"},{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"recoveryDeploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Recover Remote Operator bootstrap values for this exact existing group only if it has no deployments. Serialized with registration; never creates or rebinds a group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"}}}]},"DeploymentSetupConfigInput":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}}},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."}}},"DeploymentSetupMetadata":{"type":"object","additionalProperties":{"nullable":true}},"KubernetesClusterSource":{"type":"string","enum":["create","existing"]},"DeploymentSetupStackSettingsPolicy":{"type":"object","properties":{"defaults":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"allowedDeploymentModels":{"type":"array","items":{"type":"string","enum":["push","pull","airgapped"]}},"allowedNetworkModes":{"type":"array","items":{"type":"string","enum":["none","create","default","byo"]}},"allowedUpdatesModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required"]}},"allowedTelemetryModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required","off"]}},"allowedHeartbeatsModes":{"type":"array","items":{"type":"string","enum":["on","off"]}},"allowExternalBindings":{"type":"boolean"},"allowCustomRegistry":{"type":"boolean"}}},"EnvironmentVariableConfig":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"value":{"type":"string","maxLength":10000,"description":"Variable value (encrypted in database)"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","value","type","targetResources"]},"EnvironmentVariableType":{"type":"string","enum":["plain","secret"],"description":"Variable type (plain or secret)"},"DeploymentSetupItemSelection":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":{"type":"boolean"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"Deprecated request shorthand. Use deploymentSetupConfig.policy.allowedAIProviders."}},"required":["item","required"],"additionalProperties":false},"SetupLinkEntryPoint":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"provider":{"oneOf":[{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},{"type":"string","enum":["aws","gcp","azure"]}]}},"required":["item"],"additionalProperties":false,"description":"Portal destination to open first. This controls navigation, not authorization."},"StackInputValuesRequest":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{}},"StackInputValueRequest":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"type":"string"}}]},"ProjectIDOrNameQueryParam":{"type":"string","maxLength":100,"description":"Filter by project ID or name."},"SetDeploymentGroupExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"]},"UpdateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"maxDeployments":{"type":"integer","minimum":1,"description":"Maximum number of deployments in this deployment group"}}},"CreateDeploymentGroupTokenRequest":{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}}},"CreateFirstPartyDeploymentSessionResponse":{"type":"object","properties":{"token":{"type":"string","description":"The deployment-group session token"}},"required":["token"]},"ExternalAIBindingState":{"type":"object","properties":{"binding":{"$ref":"#/components/schemas/ExternalAIBinding"}},"required":["binding"]},"ExternalAIBinding":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"providerClientId":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialRevision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogProviderModelIds":{"type":"array","nullable":true,"items":{"type":"string"}},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"},"requiredModelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"available":{"type":"boolean","nullable":true},"accessStatus":{"type":"string","nullable":true,"enum":["verified","denied",null]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","available","accessStatus","accessObservedAt"]}},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","provider","providerEndpoint","providerClientId","keyFingerprint","credentialRevision","credentialStatus","credentialCheckedAt","catalogProviderModelIds","catalogObservedAt","requiredModelCoverage","updatedAt"]},"PutExternalAIBindingRequest":{"oneOf":[{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","openai"]},"apiKey":{"type":"string","minLength":1,"maxLength":512},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","apiKey","acknowledgeAlienCredentialAccess"],"additionalProperties":false},{"type":"object","properties":{"provider":{"type":"string","enum":["databricks"]},"workspaceUrl":{"type":"string","minLength":1,"maxLength":512},"clientId":{"type":"string","minLength":1,"maxLength":512},"clientSecret":{"type":"string","minLength":1,"maxLength":4096},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","workspaceUrl","clientId","clientSecret","acknowledgeAlienCredentialAccess"],"additionalProperties":false}]},"ExternalAIModelCheck":{"type":"object","properties":{"id":{"type":"string"},"publicModel":{"type":"string"},"status":{"type":"string","enum":["pending","running","verified","denied","failed","cancelled"]},"blockerCode":{"type":"string","nullable":true},"error":{"nullable":true},"requestedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","publicModel","status","blockerCode","requestedAt","completedAt"]},"ContainerRegistryState":{"type":"object","properties":{"route":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]},"endpoint":{"type":"object","nullable":true,"properties":{"url":{"type":"string","format":"uri"},"source":{"type":"string","enum":["runtime","custom-domain"]}},"required":["url","source"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]}}},"required":["route","endpoint","repositories","credentials"]},"CreateContainerRegistryCredentialResponse":{"type":"object","properties":{"credential":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]},"username":{"type":"string","enum":["alien"]},"password":{"type":"string"}},"required":["credential","username","password"]},"Package":{"type":"object","properties":{"id":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"type":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string","description":"Package version (e.g., '1.0.0', 'rel_abc123')"},"sourceReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release used as package build input. Null for release-less packages such as Operate Operator images.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"dependsOnPackageId":{"type":"string","nullable":true,"pattern":"pkg_[0-9a-z]{28}$","description":"Exact package dependency used as build input. Helm packages use this to identify the Operator image embedded in the chart.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"setupFingerprints":{"$ref":"#/components/schemas/SetupFingerprintMap"},"packageBuildInputHash":{"type":"string","description":"Hash of Platform-known package build request inputs: package type, source release, setup fingerprints, package config, and setup contract version"},"config":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"}},"required":["displayName","name"],"description":"Branding configuration for the deploy CLI binary."},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package paired with managed Kubernetes setup artifacts.\n\nThis is derived by the platform and is independent from the generic dependency, which\ncan point at a sandbox bundle for a mixed AWS and Kubernetes release."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for CloudFormation packages"},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image the agent binary is read from."},"baseImage":{"type":"string","description":"`custom_image` resolved to its linux/amd64 manifest, `registry/repository@sha256:...`."},"customImage":{"type":"string","description":"The developer's image as typed, which ties the package to the capability that asked."},"managerUrl":{"type":"string","description":"URL of the GCP manager whose registry proxy receives the push."}},"required":["agentImage","baseImage","customImage","managerUrl"],"description":"Configuration for a GCP sandbox image package.\n\nThe image is the developer's base with the sandbox agent and its contract layered on, pushed\ninto the project's path of the GCP manager's registry."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"managerUrl":{"type":"string","description":"Resolved default management endpoint captured when this build was queued."},"operationPermissions":{"type":"array","nullable":true,"items":{"type":"object","properties":{"operation":{"type":"string","description":"Operation name within the plugin."},"permissions":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Kubernetes API group. An empty string denotes the core API."},"reason":{"type":"string","description":"Human-readable reason the operation requires this rule."},"resource":{"type":"string","description":"Plural Kubernetes resource, optionally with a supported subresource."},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Optional concrete resource names. Empty means all names in the installation scope."},"verbs":{"type":"array","items":{"type":"string"},"description":"Concrete Kubernetes API verbs required by the operation."}},"required":["apiGroup","reason","resource","verbs"],"description":"One Kubernetes API requirement declared by an enabled operation."},"description":"Explicit Kubernetes API requirements."},"schemaVersion":{"type":"integer","minimum":0,"description":"Schema version of the validated permission declaration."}},"required":["rules","schemaVersion"],"description":"Versioned Kubernetes API requirements declared by an enabled operation."},"plugin":{"type":"string","description":"Operations plugin name."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier of an enabled operation in a Helm build snapshot."}},"required":["operation","permissions","plugin","tier"],"description":"Canonical Kubernetes permission snapshot for one enabled operation."},"description":"Canonical Kubernetes permissions for the operations enabled when this build was queued.\n\nThis is derived by the platform and persisted with the build request. It is not part of\nthe user-authored project package configuration. `None` identifies an older package row\nthat must be re-enqueued; an empty `Some` is a reviewed snapshot with no extra grants."},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","description":"Existing namespace claim instead of creating a new claim."},"size":{"type":"string","description":"Requested claim capacity, for example 1Gi."},"storageClassName":{"type":"string","description":"Cluster storage class; empty uses the cluster default."}},"required":["enabled","existingClaim","size","storageClassName"],"description":"Operator identity storage in the generated chart. This does not install a storage driver."},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","description":"Data key inside the Secret."},"name":{"type":"string","description":"Fixed Kubernetes Secret name expected by the workload's Secret mount."},"prefix":{"type":"string","description":"Plaintext prefix before the random alphanumeric suffix."},"randomLength":{"type":"integer","minimum":0,"description":"Length of the random suffix."}},"required":["key","name","prefix","randomLength"],"description":"Non-secret configuration for a chart-generated enrollment token."},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Empty string for the core Kubernetes API group."},"resources":{"type":"array","items":{"type":"string"},"description":"Kubernetes plural resource names; wildcards are not accepted."}},"required":["apiGroup","resources"],"description":"Resource family the chart grants get/list/watch over."},"description":"Exact API groups and resources. Verbs are fixed to get/list/watch."},"serviceAccountProfile":{"type":"string","description":"Permission profile used by the workload Container and generated ServiceAccount."}},"required":["rules","serviceAccountProfile"],"description":"Cluster reads granted to a workload identity, separate from Operator permissions."}},"required":["tokenSecret","workloadReadAccess"],"description":"Kubernetes resources created by the product chart before the runtime starts."}},"required":["chartName","description"],"description":"Configuration for the Helm chart package"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"}},"required":["displayName","name"],"description":"Branding configuration for the Operator image."},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image copied into the bundle."},"baseImage":{"type":"string","description":"The base container image the sandbox filesystem starts from. A release-pushed image\narrives resolved onto the private registry template with its {region} token intact."},"objectKey":{"type":"string","description":"Object key the bundle is written under in every regional bundle store."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store must receive this bundle. Part of the build input hash,\nso a newly supported region re-mints the bundle instead of silently missing it."}},"required":["agentImage","baseImage","objectKey"],"description":"Configuration for a sandbox bundle package.\n\nThe bundle is a zip holding one Dockerfile that layers the published Alien sandbox agent\nonto the vendor's base image; everything the builder writes is derived from these fields."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package used to compose managed Kubernetes modules.\n\nThis is derived by the platform and persisted with the build request. It is separate\nfrom the generic package dependency because a mixed AWS and Kubernetes release can also\ndepend on a sandbox bundle."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for Terraform package generation."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]}],"description":"Type-specific configuration"},"outputs":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"digest":{"type":"string","description":"Image digest (e.g., \"sha256:abc123...\")"},"image":{"type":"string","description":"Full image reference (e.g., \"public.ecr.aws/acme/operators/project-id:1.2.3\")"},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain packaged into the Operator image, if whitelabeled."}},"required":["digest","image"],"description":"Outputs from an Operator image package build"},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentDigest":{"type":"string","description":"Manifest digest of the linux/amd64 agent image the agent binary came from."},"baseDigest":{"type":"string","description":"Manifest digest of the linux/amd64 base the image was built from."},"digest":{"type":"string","description":"Manifest digest of the pushed image."},"image":{"type":"string","description":"Native registry reference pinned by digest, the value a GCP sandbox stack names."},"reuseKey":{"type":"string","description":"Hash of the base digest, the agent image reference and the image contract; equal keys reuse."}},"required":["agentDigest","baseDigest","digest","image","reuseKey"],"description":"Outputs from a GCP sandbox image package build."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"bundleUriTemplate":{"type":"string","description":"Bundle URI with the {region} token in the bucket, resolved by the deploy-time emitters."},"objectKey":{"type":"string","description":"Object key the bundle was written under in every regional bundle store."},"regions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store received this bundle."},"sha256":{"type":"string","description":"SHA256 checksum of the region-neutral bundle zip; a region-templated base image makes\neach regional object differ from it only in the rendered region."},"size":{"type":"integer","minimum":0,"description":"Region-neutral bundle zip size in bytes."}},"required":["bundleUriTemplate","objectKey","regions","sha256","size"],"description":"Outputs from a sandbox bundle package build."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]},{"nullable":true}],"description":"Package outputs (only when status is 'ready')"},"error":{"nullable":true,"description":"Error information if status is 'failed'"},"sourceBinarySha256":{"type":"string","nullable":true,"description":"Builder-recorded source binary SHA256 (for cli/terraform packages)"},"retries":{"type":"integer","minimum":0,"description":"Number of build retries"},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"leaseExpiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Expiration of the current builder lease"},"buildPhase":{"type":"string","nullable":true,"enum":["building","publishing",null],"description":"Coarse package build phase"},"lastProgressAt":{"type":"string","format":"date-time","nullable":true,"description":"Last successful builder lease renewal or phase change"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","projectId","workspaceId","type","status","version","setupFingerprints","packageBuildInputHash","config","retries","createdAt","updatedAt"]},"SetupFingerprintMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/SetupFingerprintInfo"},"description":"Per-target setup compatibility fingerprints copied from the source release"},"SetupFingerprintInfo":{"type":"object","properties":{"target":{"$ref":"#/components/schemas/SetupTarget"},"fingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"version":{"$ref":"#/components/schemas/SetupFingerprintVersion"}},"required":["target","fingerprint","version"]},"SetupTarget":{"type":"string","minLength":1,"description":"Stable target key for the setup contract, e.g. aws/us-east-1"},"SetupFingerprint":{"type":"string","minLength":1,"description":"Deterministic setup contract fingerprint for one setup target"},"SetupFingerprintVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup fingerprint algorithm version"},"ReleaseListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Release"},{"type":"object","properties":{"currentChannels":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannelName"},"description":"Channels for which this release is currently selected"},"commitUrl":{"type":"string","nullable":true,"format":"uri","description":"Validated canonical provider URL for the exact commit"},"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"rollout":{"type":"object","nullable":true,"properties":{"updatedCount":{"type":"integer","description":"Deployments that finished updating to this release (excludes initial provisions)"},"pendingCount":{"type":"integer","description":"Deployments currently targeting this release but not yet running it"},"avgDurationMs":{"type":"number","nullable":true,"description":"Average time from release creation until a deployment finished updating, in milliseconds"}},"required":["updatedCount","pendingCount","avgDurationMs"],"description":"Rollout stats, included when ?include=rollout is used"},"createdBy":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"User ID"},"name":{"type":"string","description":"User's display name"},"email":{"type":"string","description":"User's email address"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"}},"required":["id","name","email","image"],"description":"Platform user who created the release, included when ?include=createdBy is used"}},"required":["currentChannels","commitUrl"]}]},"ReleaseChannelName":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$"},"Release":{"type":"object","properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"projectId":{"type":"string","maxLength":128},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true},"setupFingerprints":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintMap"},{"description":"Per-target setup compatibility fingerprints for this release"}]},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"createdByUserId":{"type":"string","nullable":true,"maxLength":128,"description":"ID of the platform user who created the release, if known"},"workspaceId":{"type":"string","maxLength":128}},"required":["id","projectId","version","createdAt","setupFingerprints","workspaceId"]},"CreateReleaseRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"stack":{"$ref":"#/components/schemas/StackByPlatform"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"channel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Release channel to advance. Defaults to production."}]}},"required":["project"]},"ReleaseAuthorFilterItem":{"type":"object","properties":{"login":{"type":"string","nullable":true,"description":"Provider username (e.g., GitHub login)"},"name":{"type":"string","nullable":true,"description":"Git commit author name"},"avatarUrl":{"type":"string","nullable":true,"format":"uri","description":"Author avatar URL"}},"required":["login","name","avatarUrl"]},"ReleaseDeploymentsResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseDeploymentItem"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"},"stateCounts":{"$ref":"#/components/schemas/ReleaseRolloutStateCounts"}},"required":["items","nextCursor","stateCounts"]},"ReleaseDeploymentItem":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"deploymentGroup":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"],"description":"Deployment group this deployment belongs to"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"rolloutState":{"$ref":"#/components/schemas/ReleaseRolloutState"},"releasedAt":{"type":"string","format":"date-time","nullable":true,"description":"When this release went live on the deployment, null if it never did"},"durationMs":{"type":"integer","nullable":true,"description":"Time from release creation until the deployment finished updating, in milliseconds. Null for initial provisions and deployments that never ran this release."},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"}},"required":["id","name","status","platform","rolloutState","releasedAt","durationMs"]},"ReleaseRolloutState":{"type":"string","enum":["updated","updating","failed","pending","pinned-other","superseded","on-other"]},"ReleaseRolloutStateCounts":{"type":"object","properties":{"updated":{"type":"integer"},"updating":{"type":"integer"},"failed":{"type":"integer"},"pending":{"type":"integer"},"pinned-other":{"type":"integer"},"superseded":{"type":"integer"},"on-other":{"type":"integer"}},"required":["updated","updating","failed","pending","pinned-other","superseded","on-other"],"description":"Deployment counts per rollout state across all deployments the filters allow (ignores the state filter)"},"ReleaseChannel":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"deploymentCount":{"type":"integer","minimum":0},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","projectId","name","currentReleaseId","createdAt","updatedAt"]},"DeploymentListItemResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if in a failed state"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"$ref":"#/components/schemas/ManagerID"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentProtocolVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"DeploymentState protocol version owned by the runtime/manager"},"DeploymentPurpose":{"type":"string","enum":["application","encryption","ai","storage","container-registry","sandbox"],"description":"Operational purpose of this deployment within its customer environment."},"OperatorCapabilityReport":{"type":"object","properties":{"key":{"type":"string","minLength":1,"maxLength":128},"state":{"$ref":"#/components/schemas/OperatorCapabilityState"},"detail":{"type":"string","nullable":true,"maxLength":512}},"required":["key","state"]},"OperatorCapabilityState":{"type":"string","enum":["granted","denied","unavailable"]},"ManagerID":{"type":"string","pattern":"mgr_[0-9a-z]{28}$","description":"ID of the manager","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"DeploymentReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","minLength":1,"maxLength":256},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","version","createdAt"]},"DeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"]},"DeploymentProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"}},"required":["id","name"]},"DeploymentStats":{"type":"object","properties":{"total":{"type":"number","description":"Total number of deployments matching filters"},"byStatus":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by status (only includes statuses with non-zero counts)"},"byPlatform":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by platform (only includes platforms with non-zero counts)"},"byCurrentRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by currentReleaseId. The empty string key represents deployments with no current release (initial provisioning)."},"byPinnedRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by pinnedReleaseId among deployments that are pinned. Excludes unpinned deployments."},"byOrigin":{"type":"object","properties":{"framework":{"type":"number"},"remoteOperator":{"type":"number"}},"description":"Count of deployments introduced through each deployment path."}},"required":["total","byStatus","byPlatform","byCurrentRelease","byPinnedRelease","byOrigin"]},"DeploymentDetailResponse":{"allOf":[{"$ref":"#/components/schemas/Deployment"},{"type":"object","properties":{"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"},"operatorSync":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dosy_[0-9a-z]{28}$","description":"Unique identifier for the deployment operator sync.","example":"dosy_uxveigz3biyrosqycaqubbr"},"status":{"$ref":"#/components/schemas/DeploymentOperatorSyncStatus"},"stuckReason":{"$ref":"#/components/schemas/DeploymentOperatorSyncStuckReason"},"statusMessage":{"type":"string","nullable":true,"description":"Human-readable explanation of the status"},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash last reported by the Operator"},"missingOperations":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Expected `plugin/operation` names not reported by the Operator (catalog-mismatch only)"},"plugins":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/DeploymentOperatorSyncPlugin"},"description":"Enabled plugins compared with what the Operator last reported loading. Null when the sync fingerprints cannot be read."},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","targetBundleHash","targetSetAt"],"description":"Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments."}}}]},"ReportedOperation":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"name":{"type":"string","minLength":1,"maxLength":128}},"required":["plugin","pluginVersion","name"]},"DeploymentUpdateOperationSummary":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"status":{"$ref":"#/components/schemas/DeploymentUpdateOperationStatus"},"reasons":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentUpdateReason"}},"targetReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"changedKeys":{"type":"array","items":{"type":"string"}},"actionRequired":{"type":"string","nullable":true,"description":"Action needed before this update can execute; the current release remains installed."},"requestedAt":{"type":"string","format":"date-time"},"startedAt":{"type":"string","format":"date-time","nullable":true},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","reasons","targetReleaseId","changedKeys","requestedAt"]},"DeploymentUpdateOperationStatus":{"type":"string","enum":["blocked","queued","applying","succeeded","failed","superseded"]},"DeploymentUpdateReason":{"type":"string","enum":["configuration","redeploy","release"]},"DeploymentOperatorSyncStatus":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"DeploymentOperatorSyncStuckReason":{"type":"string","nullable":true,"enum":["download-failed","sync-stalled","catalog-mismatch",null]},"DeploymentOperatorSyncPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string","description":"Version the Operator should run"},"source":{"type":"string","enum":["builtin","custom"]},"state":{"type":"string","enum":["running","adding","updating","removing"],"description":"What the Operator still has to do for this plugin"},"previousVersion":{"type":"string","nullable":true,"description":"Version the Operator is running now (only while updating)"}},"required":["name","version","source","state"]},"Deployment":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentConnectionInfo":{"type":"object","properties":{"arc":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Manager URL for commands"},"deploymentId":{"type":"string","description":"Deployment ID to use in command requests"}},"required":["url","deploymentId"]},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"publicEndpoints":{"type":"object","additionalProperties":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"protocol":{"type":"string","enum":["http","tcp"]},"host":{"type":"string","minLength":1},"port":{"type":"integer","minimum":1,"maximum":65535},"wildcardHost":{"type":"string"}},"required":["url","protocol","host","port"]},"description":"Public endpoints keyed by endpoint name."}},"required":["type"]},"description":"Deployed resources and their public endpoints"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string"}},"required":["arc","resources","status","platform"]},"CreateDeploymentResponse":{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/Deployment"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Effective deployment model persisted for the deployment."},"token":{"type":"string","description":"Deployment token (only returned when using deployment group token)"}},"required":["deployment","deploymentModel"]},"NewDeploymentRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentGroupId":{"type":"string","description":"Required for workspace/project tokens. Deployment group tokens use their own group automatically."},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Optional manager to assign. If omitted, the project default or system manager is selected."}]},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"environmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"},"description":"Configuration of environment variables for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"Stack settings for deployment customization"},"resourcePrefix":{"$ref":"#/components/schemas/ResourcePrefix"},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method that created the deployment. Defaults to cli."}]},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup method metadata used to guide privileged teardown."}]},"inputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{},"description":"Stack input values provided by the deployment creator."},"operatorScope":{"type":"string","minLength":1,"maxLength":512,"description":"Display-only scope reported by the Operator manifest."},"operatorPermission":{"type":"string","minLength":1,"maxLength":64,"description":"Display-only permission tier reported by the Operator manifest."},"initialDesiredRelease":{"type":"string","enum":["active","none"],"default":"active","description":"Desired-release selection for a new deployment. Use none to register an environment without initially requesting a release; later updates can assign one."},"releaseChannel":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","default":"production","description":"Release channel followed while this deployment is not pinned."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Customer setup item selected from this deployment-group token."},"setupHandoff":{"type":"string","enum":["immediate","await-registration"],"default":"immediate","description":"Use await-registration when CloudFormation will create the infrastructure and register this deployment."}},"required":["name","platform","project"],"additionalProperties":false,"description":"Request schema for creating a new deployment"},"ResourcePrefix":{"type":"string","pattern":"^[a-z](?:[a-z0-9]|-(?=[a-z0-9])){1,38}[a-z0-9]$","description":"Optional physical-name prefix for generated cloud resources. Omit to let the manager generate one."},"ImportDeploymentRequest":{"oneOf":[{"$ref":"#/components/schemas/ForwardImportRequest"},{"$ref":"#/components/schemas/PersistImportedDeploymentRequest"}],"description":"Request schema for importing a deployment from resolved setup infrastructure"},"ForwardImportRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["forward"],"default":"forward"},"project":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user-session callers."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Required for user-session callers. Deployment-group tokens use their own group automatically.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager ID. If omitted, the first suitable manager for the source platform is used."}]},"source":{"$ref":"#/components/schemas/ImportSource"},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Exact item selected from a tailored customer setup link."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["source"]},"ImportSource":{"type":"object","properties":{"deploymentName":{"type":"string","minLength":1,"description":"User-chosen deployment name. Must be unique within the deployment group; the manager returns 409 on collision."},"resourcePrefix":{"allOf":[{"$ref":"#/components/schemas/ResourcePrefix"},{"description":"Stable physical-name prefix used by the setup artifact."}]},"sourceKind":{"$ref":"#/components/schemas/ImportSourceKind"},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup source metadata needed to guide privileged teardown."}]},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release that produced the setup artifact. Defaults to latest.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Cloud platform of the imported stack"},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"region":{"type":"string","description":"Region or location reported by the setup artifact"},"setupTarget":{"allOf":[{"$ref":"#/components/schemas/SetupTarget"},{"description":"Setup target this package was generated for"}]},"setupImportFormatVersion":{"$ref":"#/components/schemas/SetupImportFormatVersion"},"setupFingerprint":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprint"},{"description":"Setup compatibility fingerprint embedded in the package"}]},"setupFingerprintVersion":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintVersion"},{"description":"Setup fingerprint algorithm version embedded in the package"}]},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ImportedResource"},"minItems":1}},"required":["deploymentName","resourcePrefix","platform","region","setupTarget","setupImportFormatVersion","setupFingerprint","setupFingerprintVersion","stackSettings","resources"],"description":"Resolved setup import payload"},"ImportSourceKind":{"type":"string","enum":["cloudformation","terraform","helm"],"description":"Source label for observability only — does not affect import behavior."},"KubernetesBasePlatform":{"type":"string","enum":["aws","gcp","azure"],"description":"Base cloud platform for cloud-backed Kubernetes imports."},"SetupImportFormatVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup import payload format version embedded in the package"},"ImportedResource":{"type":"object","properties":{"id":{"type":"string","description":"Resource id from the active stack"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"importData":{"type":"object","additionalProperties":{"nullable":true},"description":"Resolved typed import payload"}},"required":["id","type","importData"]},"PersistImportedDeploymentRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["persist"]},"name":{"type":"string","minLength":1,"description":"Deployment name. Must be unique within the deployment group."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"stackState":{"nullable":true},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"runtimeMetadata":{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},"scheduleReconciliation":{"type":"boolean","default":false},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"default":"provisioning","description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"currentReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"importSource":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"setupMetadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"setupTarget":{"$ref":"#/components/schemas/SetupTarget"},"setupFingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"setupFingerprintVersion":{"$ref":"#/components/schemas/SetupFingerprintVersion"},"deploymentToken":{"type":"string"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["mode","name","deploymentGroupId","managerId","platform","stackSettings","runtimeMetadata","deploymentProtocolVersion","setupTarget","setupFingerprint","setupFingerprintVersion"]},"SetFirstPartyDeploymentInputsResponse":{"type":"object","properties":{"ok":{"type":"boolean"}},"required":["ok"]},"SetFirstPartyDeploymentInputsRequest":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"releaseChannel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["platform"]},"SetupRegistrationOperationResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"status":{"$ref":"#/components/schemas/SetupRegistrationOperationStatus"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"physicalResourceId":{"type":"string","nullable":true},"result":{"$ref":"#/components/schemas/SetupRegistrationOperationResult"},"error":{"type":"object","nullable":true,"properties":{"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["message","retryable"]}},"required":["id","action","sourceKind","status","deploymentId","physicalResourceId","result","error"]},"SetupRegistrationAction":{"type":"string","enum":["create","update","delete"]},"SetupRegistrationOperationStatus":{"type":"string","enum":["pending","processing","waiting-for-handoff","succeeded","failed","responding","responded"]},"SetupRegistrationOperationResult":{"type":"object","nullable":true,"properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentToken":{"type":"string","nullable":true},"helmValues":{"type":"string","nullable":true}},"required":["deploymentId","deploymentToken","helmValues"]},"CreateSetupRegistrationOperationRequest":{"type":"object","properties":{"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"source":{"allOf":[{"$ref":"#/components/schemas/ImportSource"}],"nullable":true},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":512},"cloudFormation":{"$ref":"#/components/schemas/SetupRegistrationCloudFormationTarget"}},"required":["action","sourceKind"],"additionalProperties":false},"SetupRegistrationCloudFormationTarget":{"type":"object","nullable":true,"properties":{"stackId":{"type":"string","minLength":1},"requestId":{"type":"string","minLength":1},"logicalResourceId":{"type":"string","minLength":1},"responseUrl":{"type":"string","format":"uri"},"physicalResourceId":{"type":"string","nullable":true,"minLength":1},"serviceTimeoutSeconds":{"type":"integer","minimum":60,"maximum":7200,"default":3300}},"required":["stackId","requestId","logicalResourceId","responseUrl"],"additionalProperties":false},"DeleteDeploymentResponse":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]},"message":{"type":"string"}},"required":["action","message"]},"DeleteDeploymentRequest":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]}},"required":["action"]},"PinReleaseRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release ID to pin the deployment to. Set to null to resume its followed channel.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for pinning/unpinning deployment release"},"DeploymentInputsResponse":{"type":"object","properties":{"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"values":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"description":"Current non-secret input values. Secret values are never returned."},"providedInputIds":{"type":"array","items":{"type":"string"},"description":"Input IDs that currently have a value, including redacted secrets."}},"required":["inputs","values","providedInputIds"]},"UpdateDeploymentComputeRequest":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]}}},"UpdateDeploymentInputsResponse":{"allOf":[{"$ref":"#/components/schemas/DeploymentInputsResponse"},{"type":"object","properties":{"runtimeUpdateRequested":{"type":"boolean"},"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["runtimeUpdateRequested","outcome","operation"]}]},"UpdateDeploymentInputsRequest":{"type":"object","properties":{"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"clearInputIds":{"type":"array","items":{"type":"string"},"default":[]}},"additionalProperties":false},"UpdateDeploymentEnvironmentVariablesRequest":{"type":"object","properties":{"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"value":{"type":"string","description":"Variable value"},"type":{"type":"string","enum":["plain","secret"],"description":"Variable type"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources)"}},"required":["name","value","type"]},"description":"Environment variables for the deployment"}},"required":["variables"],"additionalProperties":false,"description":"Request schema for updating deployment environment variables"},"CreateDeploymentTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The generated deployment token (only shown once)"},"deploymentId":{"type":"string","description":"The deployment ID that this token is scoped to"}},"required":["token","deploymentId"]},"CreateDeploymentTokenRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128,"description":"Optional description for the deployment token"},"expiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Optional expiration date for the deployment token"}},"required":["description"]},"DynamicContainerResponse":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"appliedGeneration":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"statusMessage":{"type":"string","nullable":true},"internalServices":{"type":"array","items":{"type":"object","properties":{"internalDns":{"type":"string"},"port":{"type":"integer"}},"required":["internalDns","port"]}},"deleted":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["name","spec","generation","appliedGeneration","status","statusMessage","internalServices","deleted","createdAt","updatedAt"]},"DynamicContainerName":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"DynamicContainerSpec":{"type":"object","properties":{"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"resources":{"type":"object","properties":{"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"}},"required":["cpu","memory"]},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192},"default":{}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]}},"required":["image","resources","replicas","ports"],"additionalProperties":false},"PutDynamicContainerRequest":{"type":"object","properties":{"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}}},"required":["spec"],"additionalProperties":false},"ListDeploymentMachinesResponse":{"type":"object","properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentMachine"}}},"required":["machines"]},"DeploymentMachine":{"type":"object","properties":{"clusterResourceId":{"type":"string"},"machineId":{"type":"string"},"status":{"type":"string"},"capacityGroup":{"type":"string"},"zone":{"type":"string"},"cpu":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"memory":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"storage":{"type":"object","nullable":true,"properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"workloadId":{"type":"string","nullable":true},"workloadName":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true},"schedulingMode":{"type":"string","nullable":true},"state":{"type":"string","nullable":true}},"required":["reason"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"overlayIp":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"horizondVersion":{"type":"string","nullable":true},"networkHealth":{"type":"string","enum":["unknown","healthy","degraded"]},"wireguardMesh":{"type":"object","nullable":true,"properties":{"expectedPeerCount":{"type":"integer","minimum":0},"reachablePeerCount":{"type":"integer","minimum":0},"missingPeerMachineIds":{"type":"array","items":{"type":"string"}}},"required":["expectedPeerCount","reachablePeerCount","missingPeerMachineIds"]},"wireguardMeshObservedAt":{"type":"string","nullable":true},"localOverrides":{"type":"array","items":{"type":"object","properties":{"activeDigest":{"type":"string","nullable":true},"actor":{"type":"string","nullable":true},"baseAssignmentHash":{"type":"string"},"baseDigest":{"type":"string","nullable":true},"candidateDigest":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"failureCategory":{"type":"string","nullable":true},"fallbackDigest":{"type":"string","nullable":true},"forcedStop":{"type":"boolean","nullable":true},"healthySince":{"type":"string","nullable":true},"incidentId":{"type":"string","nullable":true},"lifecycle":{"type":"string"},"phaseStartedAt":{"type":"string","nullable":true},"replicaId":{"type":"string"},"workloadName":{"type":"string"}},"required":["baseAssignmentHash","lifecycle","replicaId","workloadName"]}},"localOverridesObservedAt":{"type":"string","nullable":true},"replicaCount":{"type":"integer"}},"required":["clusterResourceId","machineId","status","capacityGroup","zone","cpu","memory","drainBlockers","drainForce","lastHeartbeat","localOverrides","replicaCount"]},"DeploymentCredentialRotationStatus":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0},"rotation":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}},"required":["deploymentId","revision","rotation"]},"DeploymentCredentialRotation":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"expiresAt":{"type":"string"}},"required":["id","revision","status","expiresAt"]},"DeploymentCredentialRotationValues":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"token":{"type":"string"}},"required":["deploymentId","revision","token"]},"VolumeRestore":{"type":"object","properties":{"id":{"type":"string","pattern":"vrst_[0-9a-z]{28}$","description":"Unique identifier for the volume restore.","example":"vrst_rs1j4dytswpy7wbc819jdcx"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string"},"ordinal":{"type":"integer","minimum":0},"snapshotId":{"type":"string"},"status":{"$ref":"#/components/schemas/VolumeRestoreStatus"},"createdBy":{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Principal that requested the restore"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true},"cancelledAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","deploymentId","resourceId","ordinal","snapshotId","status","createdBy","createdAt","updatedAt","completedAt","cancelledAt"],"description":"A request to replace one replica's persistent volume with a volume made from a snapshot"},"VolumeRestoreStatus":{"type":"string","enum":["pending","completed","cancelled"],"description":"pending: sent to the deployment until the container reports it done. If the restore fails, the container's resource shows the error and the request stays pending: retry the deployment or cancel the request. completed: the container reported the restored volume. cancelled: withdrawn before it completed."},"CreateVolumeRestoreRequest":{"type":"object","properties":{"resourceId":{"type":"string","minLength":1,"maxLength":64,"description":"ID of the container resource that owns the volume"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"snapshotId":{"type":"string","minLength":1,"maxLength":1024,"description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute Engine snapshot name, or an Azure snapshot resource ID"}},"required":["resourceId","ordinal","snapshotId"],"additionalProperties":false},"ListVolumeRestoresResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/VolumeRestore"}}},"required":["items"]},"CreateManagerResponse":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["pending"]},"setupToken":{"type":"string"},"setupTokenId":{"type":"string"},"deploymentLink":{"type":"string"},"setupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"inputValues":{"$ref":"#/components/schemas/EncryptedStackInputValues"},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8,"description":"Immutable setup items and exact sources captured when this setup link is created."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string","enum":["plain","secret"]},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"}}},"required":["name","type","targetResources"]}}},"required":["metadata","policy","environmentVariables"]},"setup":{"oneOf":[{"type":"object","properties":{"method":{"type":"string","enum":["cloudformation"]},"deploymentPortalUrl":{"type":"string"},"launchUrl":{"type":"string"},"templateUrl":{"type":"string"},"stackName":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","launchUrl","templateUrl","stackName","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["google-oauth"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"oauthStartUrl":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","oauthStartUrl","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["terraform"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"providerSource":{"type":"string"},"moduleSource":{"type":"string"},"moduleVersion":{"type":"string"},"moduleInputs":{"type":"object","additionalProperties":{"type":"string"}},"mainTf":{"type":"string"},"tfvars":{"type":"string"},"commands":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","providerSource","moduleSource","moduleInputs","mainTf","tfvars","commands","stackSettings"]}]}},"required":["managerId","setupStatus","setupToken","setupTokenId","deploymentLink","setupConfig","setup"]},"DeploymentSetupPolicy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}},"required":["allowedPlatforms","allowedSetupMethods"]},"EncryptedStackInputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/EncryptedStackInputValue"},"default":{}},"EncryptedStackInputValue":{"type":"object","properties":{"value":{"type":"string","description":"Encrypted JSON-encoded input value."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"]},"secret":{"type":"boolean","description":"Whether the original input is secret."}},"required":["value","kind","secret"]},"NewManagerRequest":{"type":"object","properties":{"name":{"type":"string"},"cloud":{"$ref":"#/components/schemas/PrivateManagerCloud"},"region":{"type":"string","minLength":1,"maxLength":64,"description":"Cloud region for the manager."},"setupMethod":{"$ref":"#/components/schemas/PrivateManagerSetupMethod"},"network":{"type":"string","enum":["create","default"],"description":"Optional network mode for the private-manager setup. Defaults to create for production isolation; default uses the provider default network for faster dev/test setup."},"otlpConfig":{"type":"object","properties":{"logsEndpoint":{"type":"string","format":"uri","description":"External OTLP logs endpoint (e.g. https://api.axiom.co/v1/logs)"},"logsAuthHeader":{"type":"string","description":"Auth header in 'key=value,...' format (e.g. 'authorization=Bearer <token>,x-axiom-dataset=<dataset>')"}},"required":["logsEndpoint","logsAuthHeader"],"description":"Optional external OTLP config for forwarding logs to Axiom, Datadog, etc. Falls back to built-in DeepStore when not set."}},"required":["name","cloud","region"]},"PrivateManagerCloud":{"type":"string","enum":["aws","gcp","azure"],"description":"Cloud where the private manager will be deployed."},"PrivateManagerSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform"],"description":"Optional setup method. Defaults to cloudformation for AWS, google-oauth for GCP, and terraform for Azure."},"ManagerRetryResponse":{"oneOf":[{"allOf":[{"$ref":"#/components/schemas/CreateManagerResponse"},{"type":"object","properties":{"mode":{"type":"string","enum":["setup"]}},"required":["mode"]}]},{"$ref":"#/components/schemas/ManagerRetryDeploymentResponse"}]},"ManagerRetryDeploymentResponse":{"type":"object","properties":{"mode":{"type":"string","enum":["deployment"]},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["provisioning"]},"deploymentId":{"type":"string"},"message":{"type":"string"}},"required":["mode","managerId","setupStatus","deploymentId","message"]},"Manager":{"type":"object","properties":{"id":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for the manager"}]},"name":{"type":"string","description":"Display name of the manager"},"targets":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms this manager can handle"},"cloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where this private manager is deployed"},"region":{"type":"string","nullable":true,"description":"Cloud region selected for this private manager"},"setupStatus":{"type":"string","nullable":true,"enum":["pending","provisioning","active","failed","deleting","deleted",null],"description":"Private manager setup lifecycle status"},"url":{"type":"string","nullable":true,"format":"uri","description":"Manager URL (self-reported via heartbeat). DeepStore endpoints are exposed through this URL (e.g., {url}/v1/logs)"},"managementConfigs":{"$ref":"#/components/schemas/ManagerManagementConfigs"},"isSystem":{"type":"boolean","description":"Whether this is a system manager (Alien-hosted)"},"workspaceId":{"type":"string","description":"The workspace ID (for system managers, this is ALIEN_WORKSPACE_ID)"},"status":{"$ref":"#/components/schemas/ManagerStatus"},"version":{"type":"string","nullable":true,"description":"Manager version (self-reported via heartbeat)"},"metrics":{"type":"object","nullable":true,"properties":{"activeDeployments":{"type":"number","description":"Number of active deployments"},"pendingDeployments":{"type":"number","description":"Number of pending deployments"},"memoryUsageMb":{"type":"number","description":"Memory usage in megabytes"},"cpuUsagePercent":{"type":"number","description":"CPU usage percentage"}},"description":"Runtime metrics (self-reported via heartbeat)"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the manager"},"logsDatabaseId":{"type":"string","nullable":true,"description":"ID of the logs database associated with this manager"},"managedDeploymentCount":{"type":"integer","minimum":0,"description":"Number of deployments currently being managed by this manager"},"defaultProjectCount":{"type":"integer","minimum":0,"description":"Number of projects that select this manager as a default manager"},"createdAt":{"type":"string","format":"date-time","description":"Timestamp when the manager was created"}},"required":["id","name","targets","managementConfigs","isSystem","workspaceId","status","managedDeploymentCount","defaultProjectCount","createdAt"],"description":"Manager schema"},"ManagerManagementConfigs":{"type":"object","properties":{"aws":{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"},"platform":{"type":"string","enum":["aws"]}},"required":["managingRoleArn","platform"]},"gcp":{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"},"platform":{"type":"string","enum":["gcp"]}},"required":["serviceAccountEmail","platform"]},"azure":{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."},"platform":{"type":"string","enum":["azure"]}},"required":["managingTenantId","oidcIssuer","oidcSubject","platform"]},"kubernetes":{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}},"description":"Per-platform management configurations for cross-account access (self-reported via heartbeat)"},"ManagerStatus":{"type":"string","enum":["healthy","degraded","unhealthy","unknown"],"description":"Current health status"},"ManagerDomainBindingResponse":{"type":"object","properties":{"managerDomainBinding":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["managerDomainBinding"]},"UpdateManagerDomainBinding":{"type":"object","properties":{"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"}},"additionalProperties":false},"UpdateManagerRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Optional release ID to update to. If not provided, the active release will be chosen","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for updating a manager to a new release"},"Event":{"type":"object","properties":{"id":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"debugSessionId":{"type":"string","nullable":true,"pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"data":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["LoadingConfiguration"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["Finished"]}},"required":["type"]},{"type":"object","properties":{"stack":{"type":"string","description":"Name of the stack being built"},"type":{"type":"string","enum":["BuildingStack"]}},"required":["stack","type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform being targeted"},"stack":{"type":"string","description":"Name of the stack being checked"},"type":{"type":"string","enum":["RunningPreflights"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"targetTriple":{"type":"string","description":"Target triple for the runtime"},"type":{"type":"string","enum":["DownloadingAlienRuntime"]},"url":{"type":"string","description":"URL being downloaded from"}},"required":["targetTriple","type","url"]},{"type":"object","properties":{"relatedResources":{"type":"array","items":{"type":"string"},"description":"All resource names sharing this build (for deduped container groups)"},"resourceName":{"type":"string","description":"Name of the resource being built"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["BuildingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being built"},"type":{"type":"string","enum":["BuildingImage"]}},"required":["image","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being pushed"},"progress":{"oneOf":[{"type":"object","properties":{"bytesUploaded":{"type":"integer","minimum":0,"description":"Bytes uploaded so far"},"layersUploaded":{"type":"integer","minimum":0,"description":"Number of layers uploaded so far"},"operation":{"type":"string","description":"Current operation being performed"},"totalBytes":{"type":"integer","minimum":0,"description":"Total bytes to upload"},"totalLayers":{"type":"integer","minimum":0,"description":"Total number of layers to upload"}},"required":["bytesUploaded","layersUploaded","operation","totalBytes","totalLayers"],"description":"Progress information for image push operations"},{"nullable":true}]},"type":{"type":"string","enum":["PushingImage"]}},"required":["image","type"]},{"type":"object","properties":{"destination":{"type":"string","nullable":true,"description":"Human-readable destination for pushed images"},"platform":{"type":"string","description":"Target platform"},"stack":{"type":"string","description":"Name of the stack being pushed"},"type":{"type":"string","enum":["PushingStack"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"resourceName":{"type":"string","description":"Name of the resource being pushed"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["PushingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"project":{"type":"string","description":"Project name"},"type":{"type":"string","enum":["CreatingRelease"]}},"required":["project","type"]},{"type":"object","properties":{"language":{"type":"string","description":"Language being compiled (rust, typescript, etc.)"},"progress":{"type":"string","nullable":true,"description":"Current progress/status line from the build output"},"type":{"type":"string","enum":["CompilingCode"]}},"required":["language","type"]},{"type":"object","properties":{"nextState":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},"suggestedDelayMs":{"type":"integer","nullable":true,"minimum":0,"description":"An suggested duration to wait before executing the next step."},"type":{"type":"string","enum":["StackStep"]}},"required":["nextState","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["GeneratingCloudFormationTemplate"]}},"required":["type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform for which the template is being generated"},"type":{"type":"string","enum":["GeneratingTemplate"]}},"required":["platform","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being provisioned"},"releaseId":{"type":"string","description":"ID of the release being deployed to the agent"},"type":{"type":"string","enum":["ProvisioningAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being updated"},"releaseId":{"type":"string","description":"ID of the new release being deployed to the agent"},"type":{"type":"string","enum":["UpdatingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being deleted"},"releaseId":{"type":"string","description":"ID of the release that was running on the agent"},"type":{"type":"string","enum":["DeletingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being debugged"},"debugSessionId":{"type":"string","description":"ID of the debug session"},"type":{"type":"string","enum":["DebuggingAgent"]}},"required":["agentId","debugSessionId","type"]},{"type":"object","properties":{"strategyName":{"type":"string","description":"Name of the deployment strategy being used"},"type":{"type":"string","enum":["PreparingEnvironment"]}},"required":["strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being deployed"},"type":{"type":"string","enum":["DeployingStack"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being tested"},"type":{"type":"string","enum":["RunningTestWorker"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpStack"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpEnvironment"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"platformName":{"type":"string","description":"Name of the platform (e.g., \"AWS\", \"GCP\")"},"type":{"type":"string","enum":["SettingUpPlatformContext"]}},"required":["platformName","type"]},{"type":"object","properties":{"repositoryName":{"type":"string","description":"Name of the docker repository"},"type":{"type":"string","enum":["EnsuringDockerRepository"]}},"required":["repositoryName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeployingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"roleArn":{"type":"string","description":"ARN of the role to assume"},"type":{"type":"string","enum":["AssumingRole"]}},"required":["roleArn","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"type":{"type":"string","enum":["ImportingStackStateFromCloudFormation"]}},"required":["cfnStackName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeletingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"bucketNames":{"type":"array","items":{"type":"string"},"description":"Names of the S3 buckets being emptied"},"type":{"type":"string","enum":["EmptyingBuckets"]}},"required":["bucketNames","type"]},{"type":"object","properties":{"deploymentGroupId":{"type":"string","description":"ID of the deployment group this slot belongs to"},"deploymentId":{"type":"string","description":"ID of the deployment that was created"},"releaseId":{"type":"string","nullable":true,"description":"Initial release the slot was created with, if any"},"type":{"type":"string","enum":["DeploymentCreated"]}},"required":["deploymentGroupId","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously live, if any"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentReleased"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release the platform was trying to deploy, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"phase":{"type":"string","enum":["preflights","provisioning","updating","deleting"],"description":"Phase of a deployment at which a failure occurred.\n\nDerived from the source deployment status: `preflights-failed` →\n`Preflights`, `provisioning-failed` → `Provisioning`, `update-failed` →\n`Updating`, `delete-failed` → `Deleting`.\n`refresh-failed` is modelled separately via `DeploymentDegraded`."},"type":{"type":"string","enum":["DeploymentFailed"]}},"required":["deploymentId","error","phase","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"type":{"type":"string","enum":["DeploymentDegraded"]}},"required":["deploymentId","error","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentRecovered"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment that was deleted"},"type":{"type":"string","enum":["DeploymentDeleted"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Name of the channel that moved"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously current, if any"},"releaseId":{"type":"string","description":"ID of the release that is now current"},"type":{"type":"string","enum":["ReleaseChannelUpdated"]}},"required":["channel","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Newly followed channel"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousChannel":{"type":"string","description":"Previously followed channel"},"type":{"type":"string","enum":["DeploymentReleaseChannelChanged"]}},"required":["channel","deploymentId","previousChannel","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release that the failed attempt was targeting, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousError":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"type":{"type":"string","enum":["DeploymentRetryRequested"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release being redeployed"},"type":{"type":"string","enum":["DeploymentRedeployRequested"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"pinnedReleaseId":{"type":"string","description":"ID of the release that is now pinned"},"previousPinnedReleaseId":{"type":"string","nullable":true,"description":"ID of the previously pinned release, if any"},"type":{"type":"string","enum":["DeploymentReleasePinned"]}},"required":["deploymentId","pinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousPinnedReleaseId":{"type":"string","description":"ID of the release that was previously pinned"},"type":{"type":"string","enum":["DeploymentReleaseUnpinned"]}},"required":["deploymentId","previousPinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"changedKeys":{"type":"array","items":{"type":"string"},"description":"Names of the environment variables that changed (added, removed, or modified)"},"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentEnvironmentUpdated"]}},"required":["changedKeys","deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"ID of the volume restore request"},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore"},"type":{"type":"string","enum":["DeploymentVolumeRestoreRequested"]}},"required":["deploymentId","ordinal","requestId","resourceId","snapshotId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume was to be replaced"},"requestId":{"type":"string","description":"ID of the cancelled volume restore request"},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"type":{"type":"string","enum":["DeploymentVolumeRestoreCancelled"]}},"required":["deploymentId","ordinal","requestId","resourceId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentDeletionRequested"]}},"required":["deploymentId","type"]},{"$ref":"#/components/schemas/DeploymentCredentialRotationEvent"}]},"state":{"oneOf":[{"type":"object","properties":{"failed":{"type":"object","properties":{"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]}},"description":"Event failed with an error"}},"required":["failed"]},{"type":"string","enum":["none"]},{"type":"string","enum":["started"]},{"type":"string","enum":["success"]}],"description":"Represents the state of an event"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","data","state","projectId","createdAt","workspaceId"]},"DeploymentCredentialRotationEvent":{"type":"object","properties":{"type":{"type":"string","enum":["DeploymentCredentialRotation"]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"rotationId":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"previousKeyId":{"type":"string"},"candidateKeyId":{"type":"string"},"actor":{"type":"object","properties":{"kind":{"type":"string","enum":["user","serviceAccount"]},"id":{"type":"string"}},"required":["kind","id"]}},"required":["type","deploymentId","rotationId","revision","status","previousKeyId","candidateKeyId","actor"]},"GenerateManagerTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string","description":"Platform JWT for authenticating with the manager"},"expiresIn":{"type":"number","nullable":true,"description":"Token lifetime in seconds"},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","description":"Manager URL for direct access"},"databaseId":{"type":"string","nullable":true,"description":"Log database ID (null if logs not configured)"},"controlPlaneUrl":{"type":"string","nullable":true,"description":"Log control plane URL (null if logs not configured)"}},"required":["accessToken","expiresIn","tokenType","managerUrl","databaseId","controlPlaneUrl"]},"GenerateManagerTokenRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to scope token access to."}},"required":["project"]},"GenerateManagerBindingTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string"}},"required":["accessToken","expiresIn","tokenType","managerUrl"]},"GenerateManagerBindingTokenRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"kind":{"type":"string","enum":["data","sandbox"],"description":"Binding kind the token resolves. Defaults to the deployment's own kind: sandbox for a sandbox deployment, data otherwise."}},"required":["deploymentId"],"additionalProperties":false},"ResolveManagerGcpOAuthProviderResponse":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId","clientSecret"]}]},"ResolveManagerGcpOAuthProviderRequest":{"type":"object","properties":{"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group bearer token whose project-level OAuth provider should be resolved."},"returnOrigin":{"type":"string","format":"uri","description":"Browser origin that will receive the Google OAuth callback result. Must be a first-party dashboard origin or the active portal origin for the deployment group's project."}},"required":["deploymentGroupToken"]},"ManagerHeartbeatResponse":{"type":"object","properties":{"acknowledged":{"type":"boolean"},"timestamp":{"type":"string"}},"required":["acknowledged","timestamp"]},"ManagerHeartbeatRequest":{"type":"object","properties":{"status":{"type":"string","enum":["healthy","degraded","unhealthy"],"description":"Current health status"},"version":{"type":"string","description":"Manager version"},"url":{"type":"string","format":"uri","description":"Manager public URL (for accessing DeepStore endpoints)"},"managementConfigs":{"allOf":[{"$ref":"#/components/schemas/ManagerManagementConfigs"},{"description":"Per-platform management configurations for cross-account access"}]},"metrics":{"type":"object","properties":{"activeDeployments":{"type":"number"},"pendingDeployments":{"type":"number"},"memoryUsageMb":{"type":"number"},"cpuUsagePercent":{"type":"number"}},"description":"Optional runtime metrics"}},"required":["status","url","managementConfigs"]},"ManagerDeployment":{"type":"object","properties":{"platform":{"type":"string","description":"Platform of the internal deployment"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status of the internal deployment"},"deploymentId":{"type":"string","description":"Internal deployment ID"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Currently deployed private manager release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Target private manager release for an in-progress update","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"error":{"nullable":true,"description":"Latest provision / upgrade / delete error"},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type"},"status":{"type":"string","description":"Resource status"},"outputs":{"type":"object","additionalProperties":{"nullable":true},"description":"Resource outputs"}},"required":["type","status"]},"description":"Simplified stack state resources"},"environmentInfo":{"nullable":true,"description":"Manager environment info"}},"required":["platform","status","deploymentId","resources"]},"ContainerRegistryManagerSnapshot":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"routes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string"},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"routableUpstreamName":{"type":"string","nullable":true},"remoteResourceRevision":{"type":"string"}},"required":["id","logicalName","desiredState","routableUpstreamName","remoteResourceRevision"],"additionalProperties":false}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"secretPrefix":{"type":"string"},"secretDigest":{"type":"string","pattern":"^[0-9a-f]{64}$"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","secretPrefix","secretDigest","scope","repositorySubset","expiresAt","revokedAt"],"additionalProperties":false}}},"required":["id","deploymentId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","repositories","credentials"],"additionalProperties":false}}},"required":["generatedAt","routes"],"additionalProperties":false},"ApplyContainerRegistrySnapshotResponse":{"type":"object","properties":{"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["applying","connected","degraded","revoked"]}},"required":["appliedRevision","status"],"additionalProperties":false},"PrepareOperatorManifestPackageResponse":{"type":"object","properties":{"package":{"$ref":"#/components/schemas/Package"}},"required":["package"]},"PrepareOperatorManifestPackageRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}},"required":["project"],"additionalProperties":false},"RenderOperatorManifestResponse":{"type":"object","properties":{"manifest":{"type":"string","description":"Rendered multi-document Kubernetes manifest"},"applyCommand":{"type":"string","description":"kubectl command for applying the manifest from a file"},"filename":{"type":"string","description":"Suggested local filename"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the manifest"},"imagePending":{"type":"boolean","description":"True when the operator image is still building. The manifest contains a placeholder image (<PENDING_IMAGE>) and must not be applied yet — re-render once the operator-image package is ready to get the real image."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["manifest","applyCommand","filename","managerUrl","imagePending","operatorImage"]},"RenderOperatorManifestRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"format":{"type":"string","enum":["raw","helm"],"default":"raw","description":"raw: a kubectl-applyable manifest for one cluster. helm: a paste-into-your-chart template whose namespace and environment name come from Helm at install time."},"environmentName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Per-environment identity. Required for raw output, ignored for helm.","example":"my-app"},"namespace":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([-a-z0-9]*[a-z0-9])?$","description":"Namespace to observe and install into. Omit for helm to use the release namespace."},"scope":{"type":"string","enum":["namespace","cluster"],"default":"namespace","description":"namespace: a namespaced Role that manages the install namespace. cluster: a ClusterRole that manages every namespace."},"labelSelector":{"type":"string","minLength":1,"maxLength":256,"description":"Optional Kubernetes label selector narrowing what is managed, applied within the scope."},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to use for the Operator image. If omitted, the latest ready operator-image package for the project is used.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group token embedded in the operator Secret"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","default":false},"podLabelKey":{"type":"string","minLength":1,"description":"Existing Pod label key to collect logs from. Set with podLabelValue."},"podLabelValue":{"type":"string","minLength":1,"description":"Existing Pod label value to collect logs from. Set with podLabelKey."}},"description":"Enable the node log collector DaemonSet for raw pod logs."},"stackSettings":{"$ref":"#/components/schemas/StackSettings"}},"required":["project","deploymentGroupToken"],"additionalProperties":false},"StackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"EcsBootstrapWriteCheckRequest":{"type":"object","properties":{"stackName":{"type":"string","pattern":"^[A-Za-z][A-Za-z0-9-]{0,127}$"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"}},"required":["stackName","accountId","region","clusterArn"],"additionalProperties":false},"RenderOperatorEcsCloudFormationResponse":{"type":"object","properties":{"template":{"type":"string","nullable":true,"description":"CloudFormation JSON for an ECS Fargate service, or null while the immutable Operator image is building. The artifact contains no bootstrap credential values."},"filename":{"type":"string","description":"Suggested local CloudFormation filename"},"stackName":{"type":"string","description":"Suggested stack name for this installation"},"deployCommand":{"type":"string","nullable":true,"description":"Local bash/zsh deploy command, or null while the image is building. Before writing a bootstrap secret, it asks Alien to verify the one-time setup token and registration state, then preserves or generates the encryption key and writes both to customer-owned Secrets Manager. Once an Operator has registered from this stack, it reuses the stored secret at its current version and never asks for a token. It passes only the secret ARN and version ID to CloudFormation."},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the task definition"},"image":{"type":"string","description":"Immutable Operator image reference, or <PENDING_IMAGE>"},"imagePending":{"type":"boolean","description":"True until a ready Operator image digest is available. A pending template must not be deployed."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["template","filename","stackName","deployCommand","managerUrl","image","imagePending","operatorImage"]},"RenderOperatorEcsCloudFormationRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"environmentName":{"type":"string","minLength":2,"maxLength":100,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Stable per-environment Remote Operator installation name"},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"},"subnetIds":{"type":"array","items":{"type":"string","pattern":"^subnet-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact subnet ID for an Operator task ENI"},"minItems":1,"maxItems":16},"securityGroupIds":{"type":"array","items":{"type":"string","pattern":"^sg-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact security group ID for an Operator task ENI"},"minItems":1,"maxItems":16},"assignPublicIp":{"type":"string","enum":["DISABLED","ENABLED"],"default":"DISABLED"},"efsFileSystemId":{"type":"string","pattern":"^fs-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS filesystem ID for the Operator identity. Omit it, with efsAccessPointId, to have the stack create retained EFS storage."},"efsAccessPointId":{"type":"string","pattern":"^fsap-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS access point ID (POSIX UID and GID 1000) on efsFileSystemId. Supply it together with efsFileSystemId."},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to pin in the task definition. If omitted, the current project package is prepared or reused.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"s3BucketArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$","description":"Exact ARN of an S3 bucket the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned S3 ceiling. Required when enabled S3 operations need ListBucket or GetObject; the generated role contains only these bucket and object ARNs."},"sqsQueueArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):sqs:[a-z0-9]+(?:-[a-z0-9]+)+:[0-9]{12}:(?:[A-Za-z0-9_-]{1,80}|[A-Za-z0-9_-]{1,75}\\.fifo)$","description":"Exact ARN of an SQS queue the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned SQS ceiling. Required when enabled SQS operations read queue attributes; the generated role contains only these queue ARNs."}},"required":["project","environmentName","accountId","region","clusterArn","subnetIds","securityGroupIds"],"additionalProperties":false},"APIKey":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"},"createdByUser":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"email":{"type":"string"},"image":{"type":"string","nullable":true}},"required":["id","email","image"],"description":"User information associated with the API key"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig","createdByUser"],"description":"API key information"},"APIKeyDeploymentSetupConfig":{"type":"object","nullable":true,"properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/APIKeyDeploymentSetupEnvironmentVariable"}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8}},"required":["metadata","policy","environmentVariables"]},"APIKeyDeploymentSetupEnvironmentVariable":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]},"CreateAPIKeyResponse":{"type":"object","properties":{"apiKey":{"type":"string","description":"The generated API key value (only shown once)"},"keyInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig"]}},"required":["apiKey","keyInfo"],"description":"Response containing the new API key and its metadata"},"CreateAPIKeyRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"scope":{"$ref":"#/components/schemas/Scope"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"required":["description","scope","expiresAt"],"description":"Request schema for creating a new API key"},"Scope":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceScope"},{"$ref":"#/components/schemas/ProjectScope"},{"$ref":"#/components/schemas/DeploymentScope"},{"$ref":"#/components/schemas/DeploymentGroupScope"},{"$ref":"#/components/schemas/ManagerScope"}],"discriminator":{"propertyName":"type","mapping":{"workspace":"#/components/schemas/WorkspaceScope","project":"#/components/schemas/ProjectScope","deployment":"#/components/schemas/DeploymentScope","deployment-group":"#/components/schemas/DeploymentGroupScope","manager":"#/components/schemas/ManagerScope"}},"description":"Scope and role configuration for service accounts"},"WorkspaceScope":{"type":"object","properties":{"type":{"type":"string","enum":["workspace"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["type","role"],"description":"Workspace-scoped configuration"},"ProjectScope":{"type":"object","properties":{"type":{"type":"string","enum":["project"]},"projectId":{"type":"string","description":"ID of the project this is scoped to"},"role":{"$ref":"#/components/schemas/ProjectRole"}},"required":["type","projectId","role"],"description":"Project-scoped configuration"},"DeploymentScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment"]},"deploymentId":{"type":"string","description":"ID of the deployment this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"},"role":{"$ref":"#/components/schemas/DeploymentRole"}},"required":["type","deploymentId","projectId","role"],"description":"Deployment-scoped configuration"},"DeploymentGroupScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"]},"deploymentGroupId":{"type":"string","description":"ID of the deployment group this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"},"role":{"$ref":"#/components/schemas/DeploymentGroupRole"}},"required":["type","deploymentGroupId","projectId","role"],"description":"Deployment group-scoped configuration"},"ManagerScope":{"type":"object","properties":{"type":{"type":"string","enum":["manager"]},"managerId":{"type":"string","description":"ID of the manager this is scoped to"},"role":{"$ref":"#/components/schemas/ManagerRole"}},"required":["type","managerId","role"],"description":"Manager-scoped configuration"},"UpdateAPIKeyRequest":{"type":"object","properties":{"enabled":{"type":"boolean"},"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"deploymentSetupConfig":{"$ref":"#/components/schemas/UpdateDeploymentSetupPolicy"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"description":"Request schema for updating an API key"},"UpdateDeploymentSetupPolicy":{"type":"object","properties":{"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"}},"required":["policy"],"description":"Editable part of a deployment link's setup config. Locked env vars and input values are preserved."},"DeleteAPIKeysRequest":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"minItems":1}},"required":["ids"]},"DomainWithUsage":{"allOf":[{"$ref":"#/components/schemas/Domain"},{"type":"object","properties":{"endpoints":{"type":"array","items":{"$ref":"#/components/schemas/DomainEndpoint"}},"usage":{"type":"object","properties":{"deploymentUrlProjects":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"portalBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true},"hostname":{"type":"string"}},"required":["id","projectId","projectName","hostname"]}},"packageDomains":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"hostname":{"type":"string"}},"required":["id","hostname"]}},"managerBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"managerId":{"type":"string"},"managerName":{"type":"string"},"hostname":{"type":"string"}},"required":["id","managerId","managerName","hostname"]}}},"required":["deploymentUrlProjects","portalBindings","packageDomains","managerBindings"]}},"required":["endpoints","usage"]}]},"Domain":{"type":"object","properties":{"id":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domain":{"type":"string"},"isSystem":{"type":"boolean"},"claimToken":{"type":"string"},"hostedZoneId":{"type":"string","nullable":true},"nameServers":{"type":"array","nullable":true,"items":{"type":"string"}},"status":{"type":"string","enum":["pending-zone-creation","pending-verification","verified","lost-verification","failed","deleting"]},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verifiedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","workspaceId","domain","isSystem","claimToken","status","createdAt","updatedAt"]},"EventListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Event"},{"type":"object","properties":{"releaseCreatedAt":{"type":"string","format":"date-time","nullable":true,"description":"createdAt of the event's referenced release, included when ?include=releaseCreatedAt is used"}}}]},"IncidentListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Incident"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"],"additionalProperties":false},"Incident":{"type":"object","properties":{"id":{"type":"string"},"number":{"type":"integer","minimum":0,"exclusiveMinimum":true},"reference":{"type":"string"},"title":{"type":"string"},"scopeLabel":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true},"sessionStatus":{"type":"string","nullable":true,"enum":["queued","running","halted","complete","error","canceled",null]},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","number","reference","title","scopeLabel","agentSessionId","sessionStatus","projectId","deploymentId","releaseId","createdAt","updatedAt"],"additionalProperties":false},"IncidentResponse":{"type":"object","properties":{"incident":{"$ref":"#/components/schemas/Incident"}},"required":["incident"],"additionalProperties":false},"ListMachinesJoinTokensResponse":{"type":"object","properties":{"tokens":{"type":"array","items":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"}}},"required":["tokens"]},"MachinesJoinTokenSummary":{"type":"object","properties":{"id":{"type":"string"},"createdAt":{"type":"string"},"createdBy":{"type":"string"},"expiresAt":{"type":"string","nullable":true},"maxJoins":{"type":"integer","nullable":true},"joinCount":{"type":"integer"},"lastUsedAt":{"type":"string","nullable":true},"revokedAt":{"type":"string","nullable":true}},"required":["id","createdAt","createdBy","joinCount"]},"CreateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RotateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RevokeMachinesJoinTokenResponse":{"type":"object","properties":{"tokenId":{"type":"string"},"revoked":{"type":"boolean"}},"required":["tokenId","revoked"]},"CancelMachinesMachineDrainResponse":{"type":"object","properties":{"machineId":{"type":"string"},"cancelled":{"type":"boolean"}},"required":["machineId","cancelled"]},"DrainMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"requested":{"type":"boolean"}},"required":["machineId","requested"]},"DrainMachinesMachineRequest":{"type":"object","properties":{"deadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"force":{"type":"boolean"}}},"RemoveMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"removed":{"type":"boolean"}},"required":["machineId","removed"]},"CommandBootstrapResponse":{"type":"object","properties":{"managerUrl":{"type":"string","format":"uri","description":"Current customer-facing manager URL"},"token":{"type":"string","minLength":1,"description":"Short-lived command capability token"},"expiresAt":{"type":"string","format":"date-time","description":"Capability expiry in RFC 3339 format"},"target":{"$ref":"#/components/schemas/CommandReceiverBootstrapTarget"}},"required":["managerUrl","token","expiresAt"]},"CommandReceiverBootstrapTarget":{"type":"object","properties":{"resourceId":{"type":"string"},"resourceType":{"type":"string","enum":["container","daemon"]}},"required":["resourceId","resourceType"],"description":"Resolved target identity; present only for receiver bootstrap"},"CommandBootstrapRequest":{"oneOf":[{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["sender"]}},"required":["deploymentId","role"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["receiver"]},"target":{"type":"string","minLength":1,"maxLength":255}},"required":["deploymentId","role","target"],"additionalProperties":false}]},"CommandListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Command"},{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/CommandDeploymentInfo"},"project":{"$ref":"#/components/schemas/CommandProjectInfo"}}}]},"CommandVerification":{"type":"object","nullable":true,"properties":{"state":{"type":"string","enum":["not-required","pending","verified","failed","skipped"],"description":"Verification outcome of an operation command."},"reason":{"type":"string","nullable":true,"description":"Present for 'failed' and 'skipped'."}},"required":["state","reason"],"description":"Verification outcome of an operation command; null for commands that are not operations"},"CommandDeploymentInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/CommandDeploymentGroupInfo"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"managerId":{"type":"string","description":"Manager ID for obtaining access tokens"},"managerUrl":{"type":"string","nullable":true,"format":"uri","description":"URL of the manager for direct payload access"},"managerName":{"type":"string","nullable":true,"description":"Human-readable name of the manager"},"managerIsSystem":{"type":"boolean","nullable":true,"description":"Whether the manager is Alien-hosted (system)"}},"required":["id","name","managerId"]},"CommandDeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"CommandProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string"}},"required":["id","name"]},"Command":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","description":"Command name (e.g., 'analyze-repository', 'sync-data')"},"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Command states in the Commands protocol lifecycle"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Delivery mode for this command (push/pull), derived from the target at creation time"},"target":{"type":"object","nullable":true,"properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to; null on commands created before target routing"},"attempt":{"type":"number","nullable":true,"description":"Current attempt number"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","nullable":true,"description":"Size of command params in bytes"},"responseSizeBytes":{"type":"number","nullable":true,"description":"Size of command response in bytes"},"createdAt":{"type":"string","format":"date-time","description":"When the command was created"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command was dispatched to the deployment"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command completed"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if command failed"},"accessRequestId":{"type":"string","nullable":true,"description":"The approved access request that authorized this operation command, if one did"},"verification":{"$ref":"#/components/schemas/CommandVerification"},"result":{"nullable":true,"description":"Decoded command result when available"},"resultAvailability":{"type":"string","enum":["available","protected"],"description":"Whether a successful operation result is included or withheld pending explicit confirmation"}},"required":["id","deploymentId","projectId","workspaceId","name","state","deploymentModel","target","attempt","deadline","requestSizeBytes","responseSizeBytes","createdAt","dispatchedAt","completedAt","error","accessRequestId","verification"]},"ListCommandNamesResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}}},"required":["names"]},"ListCommandDeploymentsResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"required":["id","name"]}}},"required":["deployments"]},"CreateCommandResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"projectId":{"type":"string","description":"Project ID (for manager to use in routing)"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"How to dispatch the command"},"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to"},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How the command is delivered to its target"},"operationResultContractPersisted":{"type":"boolean","description":"Whether an operation result contract was stored atomically with this command"}},"required":["id","projectId","deploymentModel","target","deliveryMode","operationResultContractPersisted"]},"CreateCommandRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Target deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":1,"maxLength":255,"description":"Command name (e.g., 'analyze-repository')"},"params":{"nullable":true,"description":"Command parameters for public invocation"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key for public invocation retries. Requires params; use null for a command without arguments. Reuse the same key and identical request to recover the original command for up to 24 hours. Scoped to the workspace, caller, deployment, resolved target, and command name. The first accepted request wins; changed params or deadlines do not create a new command with the same key. Omit for a new invocation without retry protection."},"target":{"type":"string","maxLength":255,"description":"Resource id the command is addressed to. Required when the deployment has more than one command-capable resource."},"initialState":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Initial state (PENDING_UPLOAD if params require upload, PENDING if inline)"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Size of command params in bytes"},"operationResultContract":{"nullable":true,"description":"Opaque operation result contract with an optional accessRequestId binding, forwarded by a manager and persisted atomically before dispatch"}},"required":["deploymentId","name"]},"ResolvedCommandTarget":{"type":"object","properties":{"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Identifies the specific resource a command is addressed to."},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How a command is delivered to its target resource.\n\nThis is a Commands-protocol-specific concept and is intentionally distinct\nfrom `DeploymentModel` (see `stack_settings.rs`), which governs the\ninfrastructure-level push/pull wiring for a deployment. Serialized\nlowercase for consistency with `CommandTargetType`."}},"required":["target","deliveryMode"]},"UpdateCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"New command state"},"attempt":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Current attempt number"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command was dispatched"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}}},"DispatchCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"DispatchCommandRequest":{"type":"object","properties":{"dispatchedAt":{"type":"string","format":"date-time","description":"When the command was dispatched"}},"required":["dispatchedAt"]},"CompleteCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"CompleteCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["SUCCEEDED","FAILED","EXPIRED"],"description":"Terminal state to transition to"},"completedAt":{"type":"string","format":"date-time","description":"When the command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}},"required":["state","completedAt"]},"IncrementCommandAttemptResponse":{"type":"object","properties":{"attempt":{"type":"integer","description":"The attempt number after the increment"}},"required":["attempt"]},"DebugSessionListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DebugSession"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"},"DebugSession":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"owner":{"type":"string","nullable":true,"maxLength":128},"state":{"$ref":"#/components/schemas/DebugSessionState"},"mode":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"provider":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Represents the target cloud platform."},"presignedUrls":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DebugPackagePresignedURLs"}},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","state","mode","presignedUrls","createdAt","expiresAt","deploymentId","projectId","workspaceId"]},"DebugSessionState":{"type":"string","enum":["pending","running","stopping","stopped","expired","failed"]},"DebugPackagePresignedURLs":{"type":"object","properties":{"readUrl":{"type":"string","maxLength":2048,"format":"uri"},"writeUrl":{"type":"string","maxLength":2048,"format":"uri"}},"required":["readUrl","writeUrl"]},"CreateDebugSessionRequest":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Override the generated id. Manager passes the registry session id so logs correlate.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"owner":{"type":"string","nullable":true,"maxLength":128},"expiresAt":{"type":"string","format":"date-time"},"state":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Initial state. Defaults to 'pending'."}]},"accessRequestId":{"type":"string","description":"The caller's own access request whose debug grant authorized this session, for the same deployment."}},"required":["deploymentId","expiresAt"]},"UpdateDebugSessionRequest":{"type":"object","properties":{"state":{"$ref":"#/components/schemas/DebugSessionState"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"expiresAt":{"type":"string","format":"date-time"}}},"DeploymentInfo":{"type":"object","properties":{"setupUpdate":{"type":"object","properties":{"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"releaseId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"}],"nullable":true},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"}],"nullable":true},"setupTarget":{"type":"string","nullable":true},"resourcePrefix":{"type":"string","nullable":true},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["deploymentId","updateOperationId","releaseId","name","platform","setupMethod","setupMetadata","setupTarget","resourcePrefix","stackSettings"]},"tokenType":{"type":"string","enum":["deployment","deployment-group"],"description":"Type of token used to authenticate this request"},"deployment":{"type":"object","properties":{"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["name","platform"],"description":"Deployment details (present when using a deployment-scoped token)"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"pinnedSubdomain":{"type":"string","nullable":true}},"required":["id","name","pinnedSubdomain"],"description":"Deployment group details (present when using a deployment-group token)"},"workspace":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"avatarUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name"]},"project":{"type":"object","properties":{"name":{"type":"string"},"portal":{"type":"object","properties":{"appearance":{"$ref":"#/components/schemas/DeploymentPortalAppearance"}},"required":["appearance"]},"stackSummary":{"type":"object","nullable":true,"properties":{"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms supported by the active release"},"requiresNetwork":{"type":"boolean","description":"Whether the stack contains resources that require cloud VPC networking"},"customerModels":{"type":"boolean","description":"Whether this release offers one remotely accessible AI resource"},"resourceCounts":{"type":"object","properties":{"workers":{"type":"integer","minimum":0},"containers":{"type":"integer","minimum":0},"daemons":{"type":"integer","minimum":0,"description":"Daemon resources that run on managed runtime machines"},"publicHttpsEndpoints":{"type":"integer","minimum":0,"description":"Resources that declare managed public HTTPS endpoint setup"},"externalInfra":{"type":"integer","minimum":0,"description":"Storage, queue, KV, vault, database, or cache resources that Kubernetes needs Terraform to provision"},"total":{"type":"integer","minimum":0}},"required":["workers","containers","publicHttpsEndpoints","externalInfra","total"]},"publicEndpoints":{"type":"array","items":{"type":"object","properties":{"resourceId":{"type":"string"},"endpointName":{"type":"string"},"hostLabel":{"type":"string"},"wildcardSubdomains":{"type":"boolean"}},"required":["resourceId","endpointName","hostLabel","wildcardSubdomains"]},"description":"Public endpoints declared by the active release stack"}},"required":["platforms","requiresNetwork","customerModels","resourceCounts","publicEndpoints"]},"generatedDomain":{"type":"object","nullable":true,"properties":{"domain":{"type":"string"},"isSystem":{"type":"boolean"}},"required":["domain","isSystem"],"description":"Parent domain for generated deployment URLs. Chosen public subdomains are only allowed when isSystem is false."}},"required":["name","portal"]},"packages":{"type":"object","properties":{"ready":{"type":"boolean","description":"True if all enabled packages are ready for deployment"},"cli":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"commandName":{"type":"string","description":"CLI command name to use in install instructions"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},"error":{"nullable":true},"installScripts":{"type":"object","properties":{"windows":{"type":"string","format":"uri"},"mac":{"type":"string","format":"uri"},"linux":{"type":"string","format":"uri"}},"required":["windows","mac","linux"],"description":"Install script URLs for each OS"}},"required":["status","commandName","installScripts"]},"cloudformation":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},"error":{"nullable":true},"mode":{"type":"string","enum":["auto","outputs"]},"launchUrl":{"type":"string","format":"uri","description":"CloudFormation launch URL"},"outputsSchema":{"nullable":true}},"required":["status","mode","launchUrl"]},"terraform":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},"error":{"nullable":true},"providerSource":{"type":"string","description":"Terraform provider source (without https://)"},"moduleSources":{"type":"object","additionalProperties":{"type":"string"},"description":"Terraform module sources by target"},"moduleVersion":{"type":"string"},"managerUrls":{"type":"object","additionalProperties":{"type":"string"},"description":"Manager URLs by Terraform target"}},"required":["status","providerSource","moduleSources","managerUrls"]},"helm":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},"error":{"nullable":true},"chartRef":{"type":"string","description":"OCI chart reference"},"managerUrlOverride":{"type":"string","format":"uri","description":"Management endpoint to supply only when this chart's captured default differs from current installation routing."},"managerFetchExample":{"type":"string"},"localImportExample":{"type":"string"}},"required":["status","chartRef"]}},"required":["ready"]},"installContext":{"type":"object","properties":{"targets":{"type":"object","additionalProperties":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managerUrl":{"type":"string","format":"uri"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"awsManagingAccountId":{"type":"string"}},"required":["platform","managerUrl"]},"description":"Deployment-session install context by Terraform/installer target"}},"required":["targets"]},"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"},"modelAvailabilitySources":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"status":{"type":"string","enum":["current","stale","invalid"]},"availability":{"$ref":"#/components/schemas/AiAvailabilityObservation"}},"required":["deploymentId","resourceId","observedAt","status"]}},"setupItems":{"type":"array","items":{"$ref":"#/components/schemas/SetupItemStatus"}},"setupConfig":{"$ref":"#/components/schemas/DeploymentInfoSetupConfig"},"readiness":{"type":"object","properties":{"status":{"type":"string","enum":["ready","notReady","unknown"]},"checks":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"status":{"type":"string","enum":["passed","failed","warning","unknown"]},"message":{"type":"string"},"checkedAt":{"type":"string"}},"required":["code","status","message","checkedAt"]}}},"required":["status","checks"]}},"required":["tokenType","workspace","project","packages","installContext","supportedRegions","modelAvailabilitySources"]},"DeploymentPortalAppearance":{"type":"object","properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}}},"SupportedCloudRegions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by this Alien environment."},"gcp":{"type":"array","items":{"type":"string"},"description":"GCP regions supported by this Alien environment."},"azure":{"type":"array","items":{"type":"string"},"description":"Azure locations supported by this Alien environment."}},"required":["aws","gcp","azure"]},"AiAvailabilityObservation":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"SetupItemStatus":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false},"status":{"type":"string","enum":["not-started","waiting","applying","verifying","connected","needs-attention","revoked"]},"deploymentIds":{"type":"array","items":{"type":"string"}},"blocker":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]}},"required":["item","source","required","status","deploymentIds"],"additionalProperties":false},"DeploymentInfoSetupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"inputValues":{"type":"array","items":{"$ref":"#/components/schemas/ResolvedStackInputSummary"}}},"required":["metadata","policy","environmentVariables"]},"ResolvedStackInputSummary":{"type":"object","properties":{"id":{"type":"string"},"label":{"type":"string"},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"]}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"provided":{"type":"boolean"}},"required":["id","label","providedBy","required","secret","provided"]},"DeploymentComputePlan":{"type":"object","properties":{"pools":{"type":"array","items":{"type":"object","properties":{"poolId":{"type":"string"},"workloads":{"type":"array","items":{"type":"string"}},"requirements":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"scale":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["fixed"]},"machines":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","machines"]},{"type":"object","properties":{"type":{"type":"string","enum":["autoscale"]},"min":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]},"max":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","min","max"]}]},"selected":{"$ref":"#/components/schemas/ComputePoolSelection"},"recommended":{"$ref":"#/components/schemas/ComputePoolSelection"},"machines":{"type":"array","items":{"type":"object","properties":{"machine":{"type":"string"},"profile":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"recommended":{"type":"boolean"}},"required":["machine","profile","recommended"]}},"errors":{"type":"array","items":{"type":"string"}}},"required":["poolId","workloads","requirements","scale","selected","recommended","machines"]}}},"required":["pools"]},"ComputePoolSelection":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"PreparedDeploymentStack":{"type":"object","properties":{"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"setup":{"$ref":"#/components/schemas/SetupFingerprintInfo"}},"required":["platform","stack","setup"]},"SlackInstallUrlResponse":{"type":"object","properties":{"url":{"type":"string","format":"uri"}},"required":["url"]},"SlackIntegrationStatus":{"type":"object","properties":{"connected":{"type":"boolean"},"slackTeamId":{"type":"string","nullable":true},"slackTeamName":{"type":"string","nullable":true},"installedByUserId":{"type":"string","nullable":true},"installedAt":{"type":"string","nullable":true},"notificationChannelId":{"type":"string","nullable":true}},"required":["connected","slackTeamId","slackTeamName","installedByUserId","installedAt","notificationChannelId"]},"SlackChannelsResponse":{"type":"object","properties":{"channels":{"type":"array","items":{"$ref":"#/components/schemas/SlackChannel"}}},"required":["channels"]},"SlackChannel":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"isMember":{"type":"boolean"}},"required":["id","name","isMember"]},"SlackNotificationChannelResponse":{"type":"object","properties":{"notificationChannelId":{"type":"string","nullable":true},"warning":{"type":"string","nullable":true}},"required":["notificationChannelId","warning"]},"SlackNotificationChannelRequest":{"type":"object","properties":{"channelId":{"type":"string","nullable":true}},"required":["channelId"]},"AgentSessionListResponse":{"type":"object","properties":{"sessions":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionListItem"}}},"required":["sessions"]},"AgentSessionListItem":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"subjectId":{"type":"string"},"subject":{"$ref":"#/components/schemas/AgentSessionSubject"},"status":{"type":"string"},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","triggerType","subjectId","subject","status","createdAt","updatedAt"]},"AgentSessionSubject":{"type":"object","properties":{"deploymentName":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"releaseCommitMessage":{"type":"string","nullable":true},"releaseCommitRef":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true}},"required":["deploymentName","deploymentGroupId","deploymentGroupName","releaseId","releaseCommitMessage","releaseCommitRef","projectId","projectName"]},"AgentSessionDetail":{"allOf":[{"$ref":"#/components/schemas/AgentSessionListItem"},{"type":"object","properties":{"resultText":{"type":"string","nullable":true},"toolNames":{"type":"array","nullable":true,"items":{"type":"string"}},"error":{"type":"string","nullable":true}},"required":["resultText","toolNames","error"]}]},"AgentSessionEventsResponse":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionEvent"}},"latestSeq":{"type":"number"},"hasMore":{"type":"boolean"}},"required":["events","latestSeq","hasMore"]},"AgentSessionEvent":{"oneOf":[{"$ref":"#/components/schemas/AgentSessionStatusEvent"},{"$ref":"#/components/schemas/AgentSessionStepEvent"},{"$ref":"#/components/schemas/AgentSessionToolCallEvent"},{"$ref":"#/components/schemas/AgentSessionToolResultEvent"},{"$ref":"#/components/schemas/AgentSessionMarkdownEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalRequestedEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalGrantedEvent"},{"$ref":"#/components/schemas/AgentSessionRestartedEvent"},{"$ref":"#/components/schemas/AgentSessionEventsTruncatedEvent"}],"discriminator":{"propertyName":"type","mapping":{"status":"#/components/schemas/AgentSessionStatusEvent","step":"#/components/schemas/AgentSessionStepEvent","tool_call":"#/components/schemas/AgentSessionToolCallEvent","tool_result":"#/components/schemas/AgentSessionToolResultEvent","markdown":"#/components/schemas/AgentSessionMarkdownEvent","approval_requested":"#/components/schemas/AgentSessionApprovalRequestedEvent","approval_granted":"#/components/schemas/AgentSessionApprovalGrantedEvent","session_restarted":"#/components/schemas/AgentSessionRestartedEvent","events_truncated":"#/components/schemas/AgentSessionEventsTruncatedEvent"}}},"AgentSessionStatusEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["status"]},"payload":{"type":"object","properties":{"status":{"type":"string"},"error":{"type":"string"}},"required":["status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStepEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["step"]},"payload":{"type":"object","properties":{"stepId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["in_progress","complete","error"]}},"required":["stepId","title","status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolCallEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolResultEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_result"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string","nullable":true},"toolName":{"type":"string","nullable":true},"ok":{"type":"boolean"},"output":{"nullable":true}},"required":["toolCallId","toolName","ok"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionMarkdownEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["markdown"]},"payload":{"type":"object","properties":{"text":{"type":"string"}},"required":["text"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalRequestedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_requested"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["approvalId","toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalGrantedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_granted"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"approvedByUserId":{"type":"string"},"approvedByName":{"type":"string","nullable":true},"source":{"type":"string","enum":["dashboard","slack"]}},"required":["approvalId","approvedByUserId","approvedByName","source"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionRestartedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["session_restarted"]},"payload":{"type":"object","properties":{"reason":{"type":"string"}},"required":["reason"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionEventsTruncatedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["events_truncated"]},"payload":{"type":"object","properties":{"limit":{"type":"number"}},"required":["limit"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStopResponse":{"type":"object","properties":{"jobId":{"type":"string"},"status":{"type":"string"},"canceled":{"type":"boolean"}},"required":["jobId","status","canceled"]},"ListOperationsPluginsResponse":{"type":"object","properties":{"plugins":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPlugin"}},"installations":{"$ref":"#/components/schemas/OperatorInstallationsRollup"}},"required":["plugins","installations"]},"OperationsPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default tier."},"builtin":{"type":"boolean","description":"True for compiled-in plugins, false for custom bundles."},"enabled":{"type":"boolean"},"operations":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPluginOperation"}}},"required":["name","version","tier","builtin","enabled","operations"]},"OperationsPluginOperation":{"type":"object","properties":{"name":{"type":"string","description":"Operation name, unique within the plugin."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier for this operation."},"description":{"type":"string","nullable":true,"description":"Human-readable description."},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for operation parameters when the plugin publishes one."},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for a successful result when the plugin publishes one."},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string"},"pollOperation":{"type":"string"},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string"}},"successField":{"type":"string"},"successValue":{"type":"string"},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"timeoutSeconds":{"type":"integer","minimum":1}},"required":["changes","pollOperation","pollParamsFromResult","successField","successValue","timeoutSeconds"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"requiredPermissions":{"type":"array","items":{"type":"string"},"description":"IDs of permission sets (see alien-permissions) this operation requires. Empty when the operation declares none."},"permissions":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetesPermissions":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["name","tier","description","inputSchema","outputSchema","timeoutSeconds","retries","verification","sensitiveOutput","requiredPermissions","permissions"]},"OperatorInstallationsRollup":{"type":"object","properties":{"total":{"type":"integer","minimum":0,"description":"Total pull-mode installations tracked."},"ready":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["total","ready","syncing","stuck"],"description":"Rollup of this project's pull-mode installations by operations-bundle sync status, reflecting the currently enabled plugin set."},"SetBuiltinOperationsPluginsResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["names","permissionDiff"]},"OperationsPermissionDiff":{"type":"object","properties":{"aws":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change adds."},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change removes from the generated cloud configuration."}},"required":["added","removed"]},"gcp":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}}},"required":["added","removed"]},"kubernetes":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}}},"required":["added","removed"]},"incompleteForPlugins":{"type":"array","items":{"type":"string"},"description":"Previously enabled plugins whose grants could not be read before this change disabled or replaced them. Added and removed grants may be incomplete; inspect existing cloud policies before applying the regenerated configuration."}},"required":["aws","gcp","kubernetes"],"description":"Cloud permission delta versus the previously enabled set."},"OperationsAwsPermissionDiffStatement":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["effect","actions","resources","condition","sources"]},"OperationsPermissionDiffSource":{"type":"object","properties":{"plugin":{"type":"string","description":"Plugin that declared the permission."},"operation":{"type":"string","description":"Operation that declared the permission."},"reason":{"type":"string","description":"Why the operation needs this permission."}},"required":["plugin","operation","reason"]},"OperationsGcpPermissionDiffGrant":{"type":"object","properties":{"permission":{"type":"string"},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"],"description":"Where setup grants the permission: the configured project, or each Cloud Storage bucket the installer lists."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["permission","scope","sources"]},"OperationsKubernetesPermissionDiffGrant":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Empty means every resource name."},"remediationOnly":{"type":"boolean","description":"True for write verbs. The Helm chart renders them only when Operator permission is set to remediation; diagnostics installs omit them."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["apiGroup","resource","verbs","resourceNames","remediationOnly","sources"]},"SetBuiltinOperationsPluginsRequest":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"},"description":"Complete set of built-in plugins to enable."}},"required":["names"],"additionalProperties":false},"OperationsBundleUploadUrlResponse":{"type":"object","properties":{"uploadUrl":{"type":"string","format":"uri","description":"Presigned S3 PUT URL to upload the bundle ZIP to."},"uploadId":{"type":"string","description":"One-time id for this upload. Pass it back verbatim to POST /plugins so the API can validate and snapshot exactly the bytes this call uploaded."},"contentType":{"type":"string","description":"Content-Type header the PUT must send (must match the signature)."}},"required":["uploadUrl","uploadId","contentType"]},"OperationsBundleUploadUrlRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."}},"required":["name"]},"PublishOperationsPluginResponse":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","version","tier","enabled","permissionDiff"]},"PublishOperationsPluginRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."},"version":{"type":"string","minLength":1,"description":"Plugin version."},"uploadId":{"type":"string","minLength":1,"description":"The uploadId returned by POST /plugins/upload-url for the ZIP just uploaded. Identifies the exact S3 object to publish — never derived from name/version, so it can't collide with any other upload."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default risk tier."},"metadata":{"type":"object","properties":{"name":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"default":"destructive"},"binaries":{"oneOf":[{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["amd64"],"additionalProperties":false},{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["arm64"],"additionalProperties":false}]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"description":{"type":"string","nullable":true,"minLength":1},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"paramsSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"permissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"requiredPermissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1,"maximum":4294967295},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string","minLength":1,"description":"Human-readable: what this operation changes."},"pollOperation":{"type":"string","minLength":1,"description":"A read-only operation in the same plugin to poll for success."},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string","minLength":1},"default":{},"description":"Poll operation param name -> field name in the write operation's own result."},"successField":{"type":"string","minLength":1,"description":"Dotted field path in the poll result that signals success."},"successValue":{"type":"string","minLength":1,"description":"The value at successField that means verified."},"retry":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"timeoutSeconds":{"type":"integer","minimum":1,"maximum":4294967295}},"required":["changes","pollOperation","successField","successValue","timeoutSeconds"],"additionalProperties":false},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string","minLength":1},"minItems":1}},"required":["kind","fields"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"],"additionalProperties":false}]},"kubernetesPermissions":{"$ref":"#/components/schemas/KubernetesPermissions"}},"required":["name","permissions"],"additionalProperties":false},"default":[]}},"required":["name","version","binaries"],"additionalProperties":false,"description":"The complete canonical metadata.json from the uploaded bundle."}},"required":["name","version","uploadId","tier","metadata"]},"KubernetesPermissions":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/Rule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false},"Rule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/Verb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"Verb":{"type":"string","enum":["get","list","watch","delete","patch"]},"SetOperationsPluginEnabledResponse":{"type":"object","properties":{"name":{"type":"string"},"builtin":{"type":"boolean"},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","builtin","enabled","permissionDiff"]},"SetOperationsPluginEnabledRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether the plugin is distributed to this project's Operators."},"dryRun":{"type":"boolean","description":"Validate the change and return its permission delta without saving it. Defaults to false."},"expectedPermissionDiff":{"allOf":[{"$ref":"#/components/schemas/OperationsPermissionDiff"},{"description":"The permission delta the caller reviewed, usually from a dry run. When set, the change is rejected with 409 if the current delta differs."}]}},"required":["enabled"]},"OperationsPolicyResponse":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"}},"default":{"type":"string","enum":["auto","manual"],"description":"Decision for commands no rule matches."}},"required":["rules","default"]},"OperationsPolicyRule":{"type":"object","properties":{"pattern":{"type":"string","description":"`plugin/operation`, `plugin/*`, or `*`."},"decision":{"type":"string","enum":["auto","manual"],"description":"auto: run immediately. manual: needs customer approval before running."},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself."}},"required":["pattern","decision"]},"UpdateOperationsPolicyRequest":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"},"description":"The full rule set (replaces the previous one)."}},"required":["rules"]},"InvokeOperationResponse":{"type":"object","properties":{"plugin":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"The operation's declared risk tier (informational)."},"decision":{"type":"string","enum":["auto","manual"],"description":"The approval decision the policy resolved to."},"status":{"type":"string","enum":["dispatched","pending-approval"],"description":"dispatched: auto-approved and running. pending-approval: needs customer sign-off."},"commandId":{"type":"string","description":"The created operation-command id when dispatched (absent when pending)."}},"required":["plugin","operation","tier","decision","status"]},"InvokeOperationRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment to run the operation against."},"plugin":{"type":"string","description":"Plugin name."},"operation":{"type":"string","description":"Operation name exposed by the plugin."},"params":{"nullable":true,"description":"JSON params passed to the operation."},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key used to deduplicate this exact target operation."},"remediationPlanId":{"type":"string","description":"A remediation plan (`plan_…`) whose access request the customer has already approved for this exact command. When set and the plan's access request was created by the caller, is `customer-approved` and lists this `plugin/operation` with these params, the invocation is authorized by that approval and dispatches immediately regardless of the project's operations policy — the customer already signed off on this exact command via the access-request flow, so the project's default `manual` policy (meant for ad-hoc, unreviewed invocations) would otherwise require a second, redundant approval for the same action. Another principal's approved request never authorizes the caller."},"accessRequestId":{"type":"string","description":"A CLI-originated access request (`accessRequest_…`, no remediation plan) the caller created and the customer has already approved covering this exact command — either an exact match or a resolved, frozen wildcard entry. Same bypass semantics as `remediationPlanId`, for requests with no investigation behind them. Set exactly one of `remediationPlanId` or `accessRequestId`, not both. With neither, any approved request the caller created covering this exact command is used."}},"required":["deploymentId","plugin","operation"]},"VerifyOperationCheckResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["verified","not-yet","failed","skipped"],"description":"verified: success condition met. not-yet: keep polling. failed: the poll operation itself reported failure. skipped: the operation has no verification spec, or the write result carries none of the fields verification needs (the caller never opted in for this invocation)."},"reason":{"type":"string","description":"Present for 'failed' and 'skipped'."},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer"},"intervalSeconds":{"type":"integer"}},"required":["maxAttempts","intervalSeconds"],"description":"The operation's declared retry policy, echoed so the caller's poll loop doesn't need its own copy."},"timeoutSeconds":{"type":"integer","description":"The operation's declared verification timeout."}},"required":["outcome"]},"VerifyOperationCheckRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment the original write command ran against."},"commandId":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Original operation command whose stored result and dispatch-time verification contract are authoritative.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"}},"required":["deploymentId","commandId"]},"AccessRequestDebugGrant":{"type":"object","nullable":true,"properties":{"tool":{"$ref":"#/components/schemas/DebugGrantTool"},"namespace":{"type":"string","example":"braintrust"},"cloudScope":{"type":"string","example":"123456789012/prod-readonly"}},"required":["tool"]},"DebugGrantTool":{"type":"string","enum":["kubectl","aws","gcloud","az"]},"AccessRequestStatus":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"CreateAccessRequest":{"type":"object","properties":{"replayKey":{"type":"string","minLength":1,"maxLength":128,"description":"Durable replay key scoped to the authenticated requester and workspace. Reusing it with a different validated payload returns ACCESS_REQUEST_REPLAY_MISMATCH."},"requestedExpiresAt":{"type":"string","format":"date-time","description":"Absolute requester deadline in UTC (Z suffix). Must be in the future and at most six hours ahead (30 seconds clock-skew tolerance). Approvals never extend it. Omit for legacy approval-window behavior."},"deploymentId":{"type":"string"},"remediationPlanId":{"type":"string","description":"Set for a plan-backed (ai-agent) request. Omit for a plan-less (CLI) request."},"title":{"type":"string","description":"Required for a plan-backed request; defaults to the operation/pattern/debug-tool for a plan-less one."},"reason":{"type":"string"},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]},"minItems":1,"description":"Plan-backed only: the exact commands the investigation is requesting."},"operation":{"type":"string","example":"kubernetes/restart-pod","description":"Plan-less, exact request: a single `plugin/operation`."},"operationPattern":{"type":"string","example":"kubernetes/*","description":"Plan-less, wildcard request: `plugin/*`. Requires `maxRisk`."},"params":{"nullable":true,"description":"Params for an exact `operation` request."},"maxRisk":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Required with `operationPattern`: the highest risk tier the wildcard grant may cover."},"debugTool":{"allOf":[{"$ref":"#/components/schemas/DebugGrantTool"},{"description":"Requests a remote-debugging grant for this tool, alongside or instead of an operations grant."}]},"debugNamespace":{"type":"string","example":"braintrust","description":"Scopes a `kubectl` debug grant to one Kubernetes namespace. Requires `debugTool: kubectl`."},"debugCloudScope":{"type":"string","example":"123456789012/prod-readonly","description":"Scopes an `aws`/`gcloud`/`az` debug grant to a customer-meaningful account/project/subscription string. Requires `debugTool` set to that provider."}},"required":["deploymentId"]},"AccessRequestApprovalMethod":{"type":"string","example":"slack"},"AccessRequestActivity":{"type":"object","properties":{"operations":{"type":"array","items":{"type":"object","properties":{"commandId":{"type":"string"},"invocationId":{"type":"string","nullable":true,"description":"The MCP invocation that dispatched the command, when MCP did."},"command":{"type":"string","description":"`plugin/operation`."},"state":{"type":"string"},"createdAt":{"type":"string"},"dispatchedAt":{"type":"string","nullable":true},"completedAt":{"type":"string","nullable":true},"verification":{"$ref":"#/components/schemas/CommandVerification"}},"required":["commandId","invocationId","command","state","createdAt","dispatchedAt","completedAt","verification"]}},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"state":{"$ref":"#/components/schemas/DebugSessionState"},"owner":{"type":"string","nullable":true},"createdAt":{"type":"string"},"expiresAt":{"type":"string"}},"required":["id","state","owner","createdAt","expiresAt"]}}},"required":["operations","debugSessions"]},"RevokeAccessRequest":{"type":"object","properties":{"reason":{"type":"string","maxLength":4096,"description":"Why the grant is withdrawn, for the audit trail."}}},"SyncListResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"userEnvironmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"deploymentToken":{"type":"string","nullable":true},"lockedBy":{"type":"string","nullable":true},"lockedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId","userEnvironmentVariables"]}}},"required":["deployments"],"description":"Full deployment records for manager operation"},"SyncListRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. Manager-scoped tokens are always constrained to their own manager ID."}]},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to include"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment status"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by deployment platform"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Filter by deployment group ID","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"limit":{"type":"integer","minimum":1,"maximum":500,"description":"Maximum records to return"}},"additionalProperties":false,"description":"Request to list full operational deployments"},"SyncAcquireResponseDeployment":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Deployment group ID the deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method recorded on the deployment when it has a setup-owned path."}]},"operationId":{"type":"string","nullable":true,"pattern":"duop_[0-9a-z]{28}$","description":"Immutable target claimed for this execution, or null for observation-only work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","nullable":true,"pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed by this manager session, or null for observation-only work.","example":"duat_uve04tou5eoua3q17dar1pz"},"current":{"$ref":"#/components/schemas/DeploymentState"},"config":{"$ref":"#/components/schemas/DeploymentConfig"}},"required":["deploymentId","projectId","deploymentGroupId","operationId","attemptId","current","config"]},"DeploymentState":{"type":"object","properties":{"currentRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}]},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"protocolVersion":{"type":"integer","minimum":0,"description":"Protocol version for cross-actor compatibility.\nAll actors (manager, push client, agent) check this before stepping.\nMismatched versions produce a clear error instead of silent corruption.\nSee docs/02-manager/10-deployment-protocol.md."},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment\nWhen true and status is a failed state, the deployment system will retry failed resources"},"runtimeMetadata":{"oneOf":[{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},{"nullable":true}]},"stackState":{"oneOf":[{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},{"nullable":true}]},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"targetRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]}},"required":["platform","protocolVersion","status"],"description":"Current deployment state (includes releases)"},"DeploymentConfig":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"volumeRestores":{"type":"array","items":{"type":"object","properties":{"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"Unique ID of this request. A controller performs each request once."},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute\nEngine snapshot name, or an Azure snapshot resource ID"}},"required":["ordinal","requestId","resourceId","snapshotId"],"description":"Replace one replica's persistent volume with a new volume made from a snapshot.\n\nThe controller stops the replica, snapshots the volume it is about to\nreplace (so the restore can be undone), creates the new volume in the same\nzone, starts the replica on it, and deletes the replaced volume."},"description":"Operator requests to replace a replica's persistent volume with a new\nvolume made from a snapshot. A container controller performs each\nrequest once, identified by its `request_id`, and reports it in\n`ContainerOutputs.volumes`."}},"required":["environmentVariables"],"description":"Deployment configuration"},"SyncContextRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the context. Manager-scoped tokens are constrained to their own manager ID."}]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false},"SyncAcquireResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"},"description":"List of acquired deployments with deployment context"},"failures":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment that failed","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"error":{"allOf":[{"$ref":"#/components/schemas/APIError"},{"description":"Error that occurred during context building"}]}},"required":["deploymentId","projectId","error"]},"description":"List of deployments that failed during context building (locks already released)"},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time","description":"When the provisional leases on the returned deployments lapse. Confirm them with sync/renew before starting work. Null when nothing was acquired."}},"required":["deployments","failures","leaseExpiresAt"],"description":"Acquired deployments and failures"},"SyncAcquireRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. If omitted, resolved from each deployment's managerId column."}]},"session":{"type":"string","description":"Unique session identifier for lock tracking"},"requestId":{"type":"string","minLength":1,"description":"Idempotency key for one logical acquire request"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to lock (for Pull model sync)"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment statuses (default: all deployment statuses)"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by platforms (default: all platforms the Manager supports)"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Filter by setup method for setup-owned acquisition paths"}]},"acquireMode":{"type":"string","enum":["runtime","setup-run","setup-teardown"],"description":"Phase ownership mode for deployment acquisition"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model from stackSettings.deploymentModel."},"supportsExecutionClaims":{"type":"boolean","enum":[true],"description":"Signals support for echoing executionClaim on renew, reconcile, and release."},"limit":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of deployments to acquire (default: 10)"}},"required":["session","requestId","deploymentModel"],"additionalProperties":false,"description":"Request to acquire deployments for processing"},"SyncReconcileResponse":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the state was reconciled"},"current":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Current deployment state after reconciliation"}]},"target":{"$ref":"#/components/schemas/TargetDeployment"},"targetOperationsBundleSet":{"$ref":"#/components/schemas/TargetOperationsBundleSet"},"targetDynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"deleted":{"type":"boolean"},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]},"suspendedReason":{"type":"string","maxLength":512}},"required":["name","generation","image","cpu","memory","replicas","ports","deleted","env","secretEnv"]},"description":"Complete release-independent dynamic container target set for a Kubernetes Operator."}},"required":["success","current"],"description":"State reconciliation result with optional target"},"TargetDeployment":{"type":"object","properties":{"config":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"volumeRestores":{"type":"array","items":{"type":"object","properties":{"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"Unique ID of this request. A controller performs each request once."},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute\nEngine snapshot name, or an Azure snapshot resource ID"}},"required":["ordinal","requestId","resourceId","snapshotId"],"description":"Replace one replica's persistent volume with a new volume made from a snapshot.\n\nThe controller stops the replica, snapshots the volume it is about to\nreplace (so the restore can be undone), creates the new volume in the same\nzone, starts the replica on it, and deletes the replaced volume."},"description":"Operator requests to replace a replica's persistent volume with a new\nvolume made from a snapshot. A container controller performs each\nrequest once, identified by its `request_id`, and reports it in\n`ContainerOutputs.volumes`."}},"required":["environmentVariables"],"description":"Deployment configuration\n\nConfiguration for how to perform the deployment.\nNote: Credentials (ClientConfig) are passed separately to step() function."},"releaseInfo":{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."}},"required":["config","releaseInfo"],"description":"Target deployment if update is needed"},"TargetOperationsBundleSet":{"type":"object","properties":{"hash":{"type":"string","minLength":1,"maxLength":256},"bundles":{"type":"array","items":{"$ref":"#/components/schemas/OperationsBundleDownload"}}},"required":["hash","bundles"],"description":"Target operations-bundle set the Operator should converge its loaded plugin registry toward."},"OperationsBundleDownload":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"url":{"type":"string","format":"uri","description":"Presigned URL to GET the bundle ZIP from. Short-lived."}},"required":["plugin","pluginVersion","url"]},"SyncReconcileRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to reconcile state for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Lock session (push model only) - verifies lock ownership"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Immutable operation claimed at acquisition. Required with attemptId for update execution.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed at acquisition. Required with operationId for update execution.","example":"duat_uve04tou5eoua3q17dar1pz"},"state":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Complete deployment state after step() execution"}]},"updateHeartbeat":{"type":"boolean","description":"Update heartbeat timestamp (for successful health checks)"},"suggestedDelayMs":{"type":"integer","minimum":0,"description":"Delay before this deployment should be acquired again."},"resourceHeartbeats":{"type":"array","items":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"description":"Latest typed resource heartbeats collected during this step."},"observedInventoryBatches":{"type":"array","items":{"$ref":"#/components/schemas/ObservedInventoryBatch"},"description":"Observed raw-resource inventory batches read during this step."},"capabilities":{"type":"array","items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Operator-reported runtime capabilities."},"operatorVersion":{"type":"string","minLength":1,"maxLength":128,"description":"Operator binary version reported by the runtime."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorImageIdentity"},"operationsReport":{"$ref":"#/components/schemas/OperationsReport"},"dynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"message":{"type":"string","maxLength":2048}},"required":["name","generation","status"]},"description":"Observed dynamic container generations from a Kubernetes Operator."}},"required":["deploymentId","state"],"additionalProperties":false,"description":"Request to reconcile deployment state"},"ObservedInventoryBatch":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"],"description":"Backend whose observer produced this snapshot."},"complete":{"type":"boolean","description":"Whether this batch is a complete replacement for the scope. Complete\nbatches tombstone previously observed rows in the same scope when they\nare absent from `resources`."},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inventoryScope":{"type":"string","description":"Stable scope for the provider list operation that produced this batch."},"observedAt":{"type":"string","format":"date-time","description":"Time the inventory scope was observed."},"resources":{"type":"array","items":{"type":"object","properties":{"alienResourceId":{"type":"string","nullable":true},"attributes":{"type":"object","properties":{},"additionalProperties":{"nullable":true}},"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"counts":{"oneOf":[{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},{"nullable":true}]},"deploymentId":{"type":"string","nullable":true},"displayName":{"type":"string"},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"images":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."},"description":"Distinct container images the resource's running instances report, when\nthe provider exposes them."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerKind":{"type":"string","description":"Provider-native kind, such as `apps/v1/Deployment`,\n`AWS::S3::Bucket`, `storage.googleapis.com/Bucket`, or an Azure\nresource type."},"providerStale":{"type":"boolean"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"rawIdentity":{"type":"string","description":"Provider-native stable identity: Kubernetes object identity, cloud ARN,\nGCP full resource name, Azure resource id, etc."},"region":{"type":"string","nullable":true},"resourceTypeHint":{"oneOf":[{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},{"nullable":true}]},"scope":{"type":"string","nullable":true},"version":{"type":"string","nullable":true,"description":"Release/version identity observed from the provider resource, when available."}},"required":["displayName","health","lifecycle","partial","providerKind","providerStale","rawIdentity"]}},"sourceKind":{"type":"string","description":"Writer/source for this inventory pass, such as `operator` or\n`manager-observer`."}},"required":["backend","complete","controllerPlatform","inventoryScope","observedAt","resources","sourceKind"]},"RemoteOperatorImageIdentity":{"type":"object","properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"}},"required":["source","packageId","packageVersion","image","digest"],"additionalProperties":false,"description":"Immutable installer receipt self-reported by a running Remote Operator. This is not independent runtime image inspection."},"OperationsReport":{"type":"object","properties":{"loadedBundleHash":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"operations":{"type":"array","items":{"$ref":"#/components/schemas/ReportedOperation"},"default":[]}},"description":"Operations bundle set the Operator currently has loaded, for plugin-sync status tracking."},"SyncRenewRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Single deployment to renew. Deprecated: use deploymentIds. Retained so a manager built against the previous API keeps renewing during rollout.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"minItems":1,"maxItems":100,"description":"Deployments to renew or confirm. Renewal is per deployment: the response reports each one independently."},"claims":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Unique identifier for the deployment update attempt.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","operationId","attemptId"]},"maxItems":100,"description":"Claim identities for deployments currently executing an update."},"session":{"type":"string","minLength":1}},"required":["session"],"additionalProperties":false},"SyncReleaseRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to release","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Session identifier to release"},"mode":{"type":"string","enum":["release","acknowledge-completed"],"description":"Defaults to release. acknowledge-completed discards an exact terminal pull receipt after a lost response; it never releases newer work or grants a live lease."},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Operation returned by acquire. Required when the lease carried update work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Attempt returned by acquire. Required when the lease carried update work.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","session"],"additionalProperties":false,"description":"Request to release deployment lock"},"ResolveResponse":{"type":"object","properties":{"managerId":{"type":"string","description":"Manager ID"},"managerName":{"type":"string","description":"Manager display name"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL"},"managerIsSystem":{"type":"boolean","description":"Whether the manager is Alien-hosted"},"managerCloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where the private manager is hosted. Null for Alien-hosted managers."},"projectId":{"type":"string","description":"Resolved project ID"},"installContext":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}},"required":["platform","managementConfig"],"description":"Target install context derived from platform-managed manager metadata. Present for cloud push platforms."}},"required":["managerId","managerName","managerUrl","managerIsSystem","projectId"]},"CloudRegionsResponse":{"type":"object","properties":{"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"}},"required":["supportedRegions"]},"BillingAuditLogRow":{"type":"object","properties":{"id":{"type":"string"},"workspaceId":{"type":"string","nullable":true},"action":{"type":"string"},"payload":{"nullable":true},"createdAt":{"type":"string"}},"required":["id","workspaceId","action","createdAt"]},"WorkspaceBillingEntitlements":{"type":"object","properties":{"planId":{"$ref":"#/components/schemas/PlanId"},"planStatus":{"$ref":"#/components/schemas/BillingPlanStatus"},"features":{"$ref":"#/components/schemas/BillingFeatureFlags"},"limits":{"$ref":"#/components/schemas/BillingLimits"},"syncedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"}},"required":["planId","planStatus","features","limits","syncedAt","stale"]},"PlanId":{"type":"string","enum":["starter","pro","pro_annual","enterprise"]},"BillingPlanStatus":{"type":"string","enum":["active","trialing","past_due","canceled","none"]},"BillingFeatureFlags":{"type":"object","properties":{"custom_domains":{"type":"boolean"},"private_managers":{"type":"boolean"},"operations_custom_plugins":{"type":"boolean"},"sso_saml":{"type":"boolean"},"audit_logs":{"type":"boolean"},"airgapped":{"type":"boolean"}},"required":["custom_domains","private_managers","operations_custom_plugins","sso_saml","audit_logs","airgapped"]},"BillingLimits":{"type":"object","properties":{"maxDeployments":{"type":"number","nullable":true},"maxProjects":{"type":"number","nullable":true},"maxSeats":{"type":"number","nullable":true},"maxCustomDomains":{"type":"number","nullable":true},"creditUsd":{"type":"number","nullable":true},"seatsIncluded":{"type":"number","nullable":true}},"required":["maxDeployments","maxProjects","maxSeats","maxCustomDomains","creditUsd","seatsIncluded"]},"WorkspaceGatewayOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"summary":{"type":"object","properties":{"totalProjects":{"type":"integer","minimum":0},"gatewayProjects":{"type":"integer","minimum":0},"activeProjects":{"type":"integer","minimum":0},"setupInProgressProjects":{"type":"integer","minimum":0},"needsAttentionProjects":{"type":"integer","minimum":0},"connectedCustomers":{"type":"integer","minimum":0}},"required":["totalProjects","gatewayProjects","activeProjects","setupInProgressProjects","needsAttentionProjects","connectedCustomers"]},"projects":{"type":"array","items":{"$ref":"#/components/schemas/GatewayProjectOverview"}}},"required":["generatedAt","summary","projects"]},"GatewayProjectOverview":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"state":{"$ref":"#/components/schemas/GatewayProjectState"},"connectedCustomers":{"type":"integer","minimum":0},"settingUpCustomers":{"type":"integer","minimum":0},"needsAttentionCustomers":{"type":"integer","minimum":0},"revokedCustomers":{"type":"integer","minimum":0}},"required":["id","name","state","connectedCustomers","settingUpCustomers","needsAttentionCustomers","revokedCustomers"]},"GatewayProjectState":{"type":"string","enum":["not-set-up","setup-in-progress","active","needs-attention"]},"GatewayKind":{"type":"string","enum":["ai","encryption","sandbox"],"description":"Alien Gateway a customer deployment runs","example":"ai"}},"parameters":{}},"paths":{"/v1/invitations/{token}":{"get":{"operationId":"getWorkspaceInvitationPreview","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation preview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitationPreview"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/memberships":{"get":{"operationId":"listMemberships","description":"List all workspaces the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listMemberships","responses":{"200":{"description":"List of user's workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Membership"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile":{"get":{"operationId":"getUserProfile","description":"Get the current user's profile and user-scoped onboarding state.","x-speakeasy-group":"user","x-speakeasy-name-override":"getProfile","responses":{"200":{"description":"User profile.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateUserProfile","description":"Update the current user's profile (display name).","x-speakeasy-group":"user","x-speakeasy-name-override":"updateProfile","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"}}}}}},"responses":{"200":{"description":"Profile updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile/setup":{"post":{"operationId":"completeUserProfileSetup","description":"Complete the required beta intake and profile setup dialog.","x-speakeasy-group":"user","x-speakeasy-name-override":"completeProfileSetup","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfileSetupRequest"}}}},"responses":{"200":{"description":"Profile setup completed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/workspaces":{"post":{"operationId":"createWorkspace","description":"Create a new workspace. The current user will be automatically added as an admin.","x-speakeasy-group":"user","x-speakeasy-name-override":"createWorkspace","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name"},"logoUrl":{"type":"string","format":"uri","description":"Optional workspace logo URL"}},"required":["name"]}}}},"responses":{"201":{"description":"Created workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Membership"}}}},"400":{"description":"Bad request - invalid workspace name.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Workspace name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces":{"get":{"operationId":"listGitNamespaces","description":"List all git namespaces (GitHub installations) the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaces","parameters":[{"schema":{"type":"string","enum":["github"],"default":"github"},"required":false,"name":"provider","in":"query"}],"responses":{"200":{"description":"List of user's git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/sync":{"post":{"operationId":"syncGitNamespaces","description":"Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.","x-speakeasy-group":"user","x-speakeasy-name-override":"syncGitNamespaces","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github"],"description":"Git provider to sync"}},"required":["provider"]}}}},"responses":{"200":{"description":"Synced git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/{id}/repositories":{"get":{"operationId":"listGitNamespaceRepositories","description":"List repositories accessible through a git namespace (GitHub installation).","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaceRepositories","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","description":"Search query to filter repositories by name"},"required":false,"description":"Search query to filter repositories by name","name":"search","in":"query"}],"responses":{"200":{"description":"List of repositories.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitRepository"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Git namespace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/pending":{"get":{"operationId":"getPendingWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"required":true,"name":"workspace","in":"query"}],"responses":{"200":{"description":"An active invitation addressed to the signed-in user for this workspace, if any.","content":{"application/json":{"schema":{"type":"object","properties":{"invitationId":{"type":"string","nullable":true,"pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"}},"required":["invitationId"]}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/{token}/accept":{"post":{"operationId":"acceptWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptWorkspaceInvitationResponse"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/whoami":{"get":{"operationId":"whoami","description":"Get the current authenticated principal (user or service account). Works with both session cookies and API keys.","x-speakeasy-group":"auth","x-speakeasy-name-override":"whoami","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","example":"my-workspace"},"required":false,"description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current authenticated principal.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Subject"}}}},"400":{"description":"Missing required workspace for user credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export":{"get":{"operationId":"getProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Configuration and delivery status; headers are never returned.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string","maxLength":2048,"format":"uri"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}}},"required":["endpoint","enabled"]}}}},"responses":{"200":{"description":"Saved configuration. Changes take effect within 30 seconds.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export/test":{"post":{"operationId":"testProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Result of sending one test log to the saved destination.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}":{"get":{"operationId":"getLogExportDeliveryConfig","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"responses":{"200":{"description":"Private runtime configuration for the assigned manager.","content":{"application/json":{"schema":{"type":"object","nullable":true,"properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}},"revision":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}},"required":["endpoint","enabled","headers","revision","updatedAt"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}/status":{"post":{"operationId":"reportLogExportDelivery","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"revision":{"type":"string"},"succeeded":{"type":"boolean"},"error":{"type":"string","nullable":true,"enum":["timeout","connection","destination-rejected","invalid-destination","overflow",null]},"statusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599}},"required":["revision","succeeded","error"]}}}},"responses":{"200":{"description":"Delivery status recorded for the current configuration revision.","content":{"application/json":{"schema":{"type":"object","properties":{"accepted":{"type":"boolean"}},"required":["accepted"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces":{"get":{"operationId":"listWorkspaces","description":"Retrieve all workspaces.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search workspaces by name"},"required":false,"description":"Search workspaces by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Workspace"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}":{"get":{"operationId":"getWorkspace","description":"Retrieve a workspace by ID.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspace","description":"Update a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"}}}}}},"responses":{"200":{"description":"Workspace updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteWorkspace","description":"Delete a workspace. The workspace must have no projects.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Workspace deleted successfully."},"400":{"description":"Workspace still has projects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members":{"get":{"operationId":"listWorkspaceMembers","description":"List all members of a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"listMembers","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"List of workspace members.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceMember"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"addWorkspaceMember","description":"Add a member to a workspace by email. The user must already have an account.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"addMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email","description":"Email of the user to add"},"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"Role to assign"}]}},"required":["email","role"]}}}},"responses":{"201":{"description":"Member added successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"404":{"description":"Workspace or user not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"User is already a member.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members/{userId}":{"patch":{"operationId":"updateWorkspaceMember","description":"Update a workspace member's role.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"New role to assign"}]}},"required":["role"]}}}},"responses":{"200":{"description":"Member role updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"400":{"description":"Cannot remove last admin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"removeWorkspaceMember","description":"Remove a member from a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"removeMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Member removed successfully."},"400":{"description":"Cannot remove last admin or self.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/settings":{"get":{"operationId":"getWorkspaceSettings","description":"Read the ai-agent settings for a workspace. Returns defaults (`enabled: true`) when the workspace has never customized them.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"getSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspaceSettings","description":"Update the ai-agent settings for a workspace. Supports `enabled` (`false` turns the ai-agent off so incoming triggers are rejected before any session runs).","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkspaceSettingsRequest"}}}},"responses":{"200":{"description":"Updated ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations":{"get":{"operationId":"listWorkspaceInvitations","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Pending invitations.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceInvitation"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["email","role"]}}}},"responses":{"201":{"description":"Invitation created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"403":{"description":"Seat limit reached.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}/resend":{"post":{"operationId":"resendWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Invitation email sent again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}":{"delete":{"operationId":"revokeWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invitation revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invite-link":{"get":{"operationId":"getWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Active invite link.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"createWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["role"]}}}},"responses":{"200":{"description":"Invite link created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invite link revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects":{"get":{"operationId":"listProjects","description":"Retrieve all projects.","x-speakeasy-group":"projects","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search projects by name"},"required":false,"description":"Search projects by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deploymentCount","latestRelease"]},"description":"Optional fields to include: deploymentCount, latestRelease"},"required":false,"description":"Optional fields to include: deploymentCount, latestRelease","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved projects.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createProject","description":"Create a new project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"enabledCapabilities":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"minItems":1,"maxItems":5}},"required":["name"]}}}},"responses":{"201":{"description":"Project created successfully.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"}}}]}}}},"400":{"description":"Invalid request or GitHub repository connection failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}":{"get":{"operationId":"getProject","description":"Retrieve a project by ID or name.","x-speakeasy-group":"projects","x-speakeasy-name-override":"get","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateProject","description":"Update a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"update","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProject"}}}},"responses":{"200":{"description":"Project updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"403":{"description":"Project update permission is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this project's release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request or package settings are invalid or incomplete.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteProject","description":"Delete a project. The project must have no deployments.","x-speakeasy-group":"projects","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Project deleted successfully."},"400":{"description":"Project still has deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/gcp-oauth-provider":{"get":{"operationId":"getProjectGcpOAuthProvider","description":"Retrieve redacted project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectGcpOAuthProvider","description":"Update project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"updateGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProjectGcpOAuthProvider"}}}},"responses":{"200":{"description":"Google Cloud OAuth provider settings updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"400":{"description":"Invalid provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/source":{"post":{"operationId":"configureProjectSource","description":"Connect a GitHub repository or Alien template to an existing project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureSource","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["repository"]},"gitRepository":{"type":"object","properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","gitRepository"]},{"type":"object","properties":{"mode":{"type":"string","enum":["template"]},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","targetNamespace","templatePath"]}]}}}},"responses":{"200":{"description":"Project source connected.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}}}]}}}},"400":{"description":"Repository or template configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Template fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-portal-domain":{"get":{"operationId":"getProjectDeploymentPortalDomain","description":"Get the deployment portal domain binding for a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentPortalDomain","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment portal domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentPortalDomainResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/import-template":{"post":{"operationId":"createProjectFromTemplate","description":"Create a project by forking alienplatform/alien into your namespace.","x-speakeasy-group":"projects","x-speakeasy-name-override":"createFromTemplate","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$","description":"GitHub owner namespace (user or organization) that will receive the fork"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"}},"required":["name","targetNamespace","templatePath"]}}}},"responses":{"201":{"description":"Project created successfully from template.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}},"required":["template"]}]}}}},"400":{"description":"Bad request or GitHub integration not installed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/template-urls":{"get":{"operationId":"getProjectTemplateUrls","description":"Get template URLs for deploying setup stacks in this project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getTemplateUrls","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Template URLs retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"aws":{"type":"object","nullable":true,"properties":{"templateUrl":{"type":"string","format":"uri","description":"URL to download the CloudFormation template"},"launchStackUrl":{"type":"string","format":"uri","description":"URL to launch the template in the AWS CloudFormation console"}},"required":["templateUrl","launchStackUrl"],"description":"Template URLs for deploying an AWS setup stack"}}}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-link-setup":{"get":{"operationId":"getProjectDeploymentLinkSetup","description":"Get the active release stack and portal-visible setup availability for deployment-link configuration.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentLinkSetup","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment-link setup retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentLinkSetupResponse"}}}},"400":{"description":"The project's sandbox follows an Alien default image this environment does not configure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or active release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/active-release":{"get":{"operationId":"getProjectActiveRelease","description":"Get the production channel's current release. When deploymentId is provided, returns that deployment's effective release: its pin, or its followed channel's current release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getActiveRelease","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Optional deployment ID to check for pinned release"},"required":false,"description":"Optional deployment ID to check for pinned release","name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Effective release retrieved successfully.","content":{"application/json":{"schema":{"nullable":true}}}},"404":{"description":"Project or effective release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models/impact":{"post":{"operationId":"previewProjectModelsImpact","description":"Preview which customer model connections a configuration change may affect.","x-speakeasy-group":"projects","x-speakeasy-name-override":"previewModelsImpact","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Model configuration impact.","content":{"application/json":{"schema":{"type":"object","properties":{"connectedCustomers":{"type":"integer","minimum":0},"affectedCustomers":{"type":"integer","minimum":0},"verificationNeeded":{"type":"integer","minimum":0},"affected":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"provider":{"type":"string"},"reason":{"type":"string","enum":["provider-no-longer-compatible","required-model-not-in-catalog"]}},"required":["deploymentGroupId","name","externalId","provider","reason"]}},"truncated":{"type":"boolean"}},"required":["connectedCustomers","affectedCustomers","verificationNeeded","affected","truncated"]}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities":{"put":{"operationId":"setProjectCapabilities","description":"Set the capabilities offered by a Project. Removing a capability prevents new setup without deleting existing customer resources.","x-speakeasy-group":"projects","x-speakeasy-name-override":"setCapabilities","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"maxItems":5}},"required":["enabled"],"additionalProperties":false}}}},"responses":{"200":{"description":"The Project's enabled capabilities.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/deployments":{"put":{"operationId":"configureProjectDeployments","description":"Enable deployments for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureDeployments","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled","methods"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployments enabled for the Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-provider-headers":{"get":{"operationId":"getProjectAiProviderHeaders","description":"Get static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Static AI provider headers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"configureProjectAiProviderHeaders","description":"Replace the static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"responses":{"200":{"description":"Static AI provider headers updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"400":{"description":"Provider header configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models":{"put":{"operationId":"configureProjectModels","description":"Configure customer-owned model providers without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureModels","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Customer Models configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/keys":{"put":{"operationId":"configureProjectKeys","description":"Enable customer-owned application encryption without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["applicationEncryption"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Key configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/buckets":{"put":{"operationId":"configureProjectBuckets","description":"Enable buckets without requiring a project Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureBuckets","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"access":{"type":"string","enum":["read-write"]}},"required":["access"],"additionalProperties":false}}}},"responses":{"200":{"description":"Buckets configured and their exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/registry":{"put":{"operationId":"configureProjectRegistry","description":"Enable customer-owned container registries without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRegistry","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["repositories","credentialPolicy"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Registry configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox":{"put":{"operationId":"configureProjectRemoteSandbox","description":"Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRemoteSandbox","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureRemoteSandboxRequest"}}}},"responses":{"200":{"description":"Sandbox configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"400":{"description":"The sandbox configuration cannot be satisfied by this environment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The request body is invalid, including a per-cloud field.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The image's registry or Alien's GCP image service could not be reached, or the save's GCP image could not be queued; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox/base-image-repository":{"post":{"operationId":"ensureProjectSandboxBaseImageRepository","description":"Ensure the project's private image repository exists and return where to push a private sandbox base image. Name the pushed image as the remote sandbox base image afterwards.","x-speakeasy-group":"projects","x-speakeasy-name-override":"ensureSandboxBaseImageRepository","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Repository ready to receive a push.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SandboxBaseImageRepository"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found, or no AWS manager serves it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager could not prepare the repository.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The project's manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/overview":{"get":{"operationId":"getProjectCapabilityOverview","description":"Get safe, server-derived capability status for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getCapabilityOverview","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Project capability overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilityOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-bindings/access":{"post":{"operationId":"createRemoteBindingsExternalAccess","tags":["remote-bindings"],"summary":"Create short-lived Remote Bindings access for a external resource","description":"Selects a connected external resource by Project and external ID, then returns a short-lived deployment-scoped Manager capability. The caller never receives the external cloud credentials from Platform.","x-speakeasy-group":"remoteBindings","x-speakeasy-name-override":"createExternalAccess","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessRequest"}}}},"responses":{"200":{"description":"Short-lived Remote Bindings access was created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessResponse"}}}},"401":{"description":"The API key is missing, invalid, expired, or disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot access Remote Bindings for this Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The Project or external ID was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"More than one active external resource matched.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The external resource or its assigned Manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary":{"get":{"operationId":"getRemoteOperatorProjectSummary","tags":["projects"],"summary":"Get the authoritative Remote Operator project summary","x-speakeasy-group":"projects","x-speakeasy-name-override":"getRemoteOperatorSummary","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Authoritative Remote Operator state composed from existing owners.","content":{"application/json":{"schema":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"nextAction":{"type":"object","properties":{"kind":{"type":"string","enum":["connect","inspect","reconnect","verify","update","wait","none"]},"target":{"type":"string","enum":["setup","deployment","releases","access","operations","activity"]},"deploymentId":{"type":"string","nullable":true},"message":{"type":"string"}},"required":["kind","target","deploymentId","message"]},"installations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroupId":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs","unknown"]},"region":{"type":"string","nullable":true},"state":{"type":"string","enum":["unhealthy","stale","connecting","unverified","verified"]},"stateReason":{"type":"string"},"status":{"type":"string"},"lastHeartbeatAt":{"type":"string","nullable":true,"format":"date-time"},"lastSuccessfulDiagnosticAt":{"type":"string","nullable":true,"format":"date-time"},"operatorVersion":{"type":"string","nullable":true},"operatorScope":{"type":"string","nullable":true},"operatorPermission":{"type":"string","nullable":true},"expectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"previousExpectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"runningImage":{"$ref":"#/components/schemas/ObservedRemoteOperatorImageIdentity"},"imageStatus":{"type":"string","enum":["matching","drifted","unreported","unconfigured"]},"operatorUpdate":{"type":"object","nullable":true,"properties":{"packageId":{"type":"string"},"packageVersion":{"type":"string"},"image":{"type":"string"},"digest":{"type":"string"},"builtAt":{"type":"string","format":"date-time"}},"required":["packageId","packageVersion","image","digest","builtAt"],"description":"The ready Operator image selected by the project's current configuration when it differs from the image this installation was set up with. Re-applying setup installs it. Null when the installation already uses it, its install identity is unknown, or the selected package is not ready."},"operationSync":{"type":"object","nullable":true,"properties":{"status":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"string","nullable":true}},"required":["status","targetBundleHash","observedBundleHash","targetSetAt","observedAt","error"]},"application":{"type":"object","properties":{"state":{"type":"string","enum":["no-desired","up-to-date","update-required","unknown","failed"],"description":"How the application release the Operator reports compares with the desired release. Alien never applies the change; the customer applies it through their own release process."},"reason":{"type":"string"},"reported":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The application release the Operator reports"},"desired":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["channel","pin"]},"helmChart":{"type":"object","nullable":true,"properties":{"chart":{"type":"string"},"version":{"type":"string"}},"required":["chart","version"],"description":"The Helm chart built for this release, when the release has one"},"images":{"type":"array","items":{"type":"string"},"description":"Container images the release records for AWS, in resource order"}},"required":["releaseId","version","source","helmChart","images"],"description":"The release the deployment should run: its pinned release or its channel's release"},"releaseChannel":{"type":"string","description":"The release channel the deployment follows when unpinned"},"rollback":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The release the deployment reported before it moved to the desired release"}},"required":["state","reason","reported","desired","releaseChannel","rollback"]},"permissions":{"type":"object","properties":{"status":{"type":"string","enum":["current","outdated","unknown"],"description":"Whether the Kubernetes RBAC and cloud IAM recorded for this installation match the permissions compiled from the currently enabled operations."},"recordedAt":{"type":"string","nullable":true,"format":"date-time","description":"When setup was issued or last re-applied; null when nothing was recorded."},"reason":{"type":"string"}},"required":["status","recordedAt","reason"],"description":"Installed cloud and Kubernetes permissions. Setup applies them, so enabling or disabling operations changes them only after the installation's setup is re-applied."}},"required":["id","name","deploymentGroupId","platform","region","state","stateReason","status","lastHeartbeatAt","lastSuccessfulDiagnosticAt","operatorVersion","operatorScope","operatorPermission","expectedImage","previousExpectedImage","runningImage","imageStatus","operatorUpdate","operationSync","application","permissions"]}},"unregisteredSetups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs"]},"createdAt":{"type":"string","format":"date-time"},"valuesExpireAt":{"type":"string","nullable":true,"format":"date-time","description":"When the newest installation values stop working. Resuming setup can replace them."}},"required":["deploymentGroupId","name","platform","createdAt","valuesExpireAt"]},"description":"Setups whose installation values were created but whose Operator never registered, newest first."}},"required":["items","unregisteredSetups"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"release":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"reported":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"deployments":{"type":"integer","minimum":0,"exclusiveMinimum":true},"latest":{"type":"boolean"}},"required":["releaseId","version","createdAt","deployments","latest"]},"description":"Application releases that Remote Operator deployments report, newest first. The newest reported release is latest."},"older":{"type":"integer","minimum":0,"description":"Deployments without a desired release that report a release older than the latest reported release"},"unknown":{"type":"integer","minimum":0,"description":"Deployments that report no application release"},"rollout":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"upToDate":{"type":"integer","minimum":0},"waiting":{"type":"integer","minimum":0},"unknown":{"type":"integer","minimum":0},"failed":{"type":"integer","minimum":0}},"required":["releaseId","version","upToDate","waiting","unknown","failed"]},"description":"Desired releases, most deployments first, with how many Remote Operator deployments run each one, still need the change, report no release, or failed after it"}},"required":["reported","older","unknown","rollout"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"access":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"pending":{"type":"integer","minimum":0},"active":{"type":"integer","minimum":0},"recent":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"approvedUntil":{"type":"string","nullable":true,"format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","title","status","approvedUntil","updatedAt"]}}},"required":["pending","active","recent"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"operations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"selected":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["builtin","custom"]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]}},"required":["name","tier"]}}},"required":["name","version","source","operations"]}},"sync":{"type":"object","properties":{"preparing":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"ready":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["preparing","syncing","ready","stuck"]},"generatedPermissions":{"type":"array","items":{"type":"object","properties":{"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]},"cloud":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetes":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["plugin","pluginVersion","operation","tier","cloud"]}}},"required":["selected","sync","generatedPermissions"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"activity":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"recent":{"type":"array","items":{"type":"object","properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string","nullable":true},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","nullable":true},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt"]}},"investigations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"deploymentId":{"type":"string"},"status":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","triggerType","deploymentId","status","createdAt","updatedAt"]},"description":"Recent agent sessions about Remote Operator deployments or their access requests"},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"state":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","state","createdAt","expiresAt"]}},"lastVerifiedOperation":{"type":"object","nullable":true,"properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string"},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","enum":["SUCCEEDED"]},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verification":{"type":"object","properties":{"state":{"type":"string","enum":["not-required","verified","skipped"]},"attempts":{"type":"integer","minimum":0},"maxAttempts":{"type":"integer","minimum":0},"deadline":{"type":"string","nullable":true,"format":"date-time"},"reason":{"type":"string","nullable":true}},"required":["state","attempts","maxAttempts","deadline","reason"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"resultAvailable":{"type":"boolean"},"result":{"nullable":true},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt","verification","sensitiveOutput","resultAvailable","completedAt"]}},"required":["recent","investigations","debugSessions","lastVerifiedOperation"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]}},"required":["generatedAt","project","nextAction","installations","release","access","operations","activity"]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-image":{"post":{"operationId":"acceptRemoteOperatorImage","tags":["projects"],"summary":"Accept a reported image for a Remote Operator installation","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorImage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"responses":{"200":{"description":"The observed immutable image is now the accepted desired image.","content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"400":{"description":"The deployment is not a Remote Operator installation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The requested image is not the image in the latest Operator heartbeat.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-permissions":{"post":{"operationId":"acceptRemoteOperatorPermissions","tags":["projects"],"summary":"Record that a Remote Operator installation's setup was re-applied","description":"Records the permissions compiled from the currently enabled operations as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorPermissions","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"reviewedPermissions":{"type":"array","items":{"$ref":"#/components/schemas/RemoteOperatorPermissionPlugin"},"description":"The enabled operations' permission declarations that the owner reviewed and re-applied."}},"required":["reviewedPermissions"]}}}},"responses":{"200":{"description":"The current permissions are recorded as installed.","content":{"application/json":{"schema":{"type":"object","properties":{"recordedAt":{"type":"string","format":"date-time"}},"required":["recordedAt"]}}}},"400":{"description":"The deployment is not a Kubernetes or ECS Remote Operator installation, or an enabled operation is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The enabled operations changed after the reviewed permissions were loaded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-metrics":{"get":{"operationId":"getProjectAiUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe AI Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"pricing":{"type":"object","properties":{"label":{"type":"string","enum":["Estimated provider cost"]},"coverage":{"type":"number","minimum":0,"maximum":1},"revision":{"type":"string","nullable":true}},"required":["label","coverage","revision"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","deploymentGroupId","name","externalId"]}},"models":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"publicModel":{"type":"string"},"provider":{"type":"string"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","publicModel","provider"]}},"customersTruncated":{"type":"boolean"},"modelsTruncated":{"type":"boolean"}},"required":["status","range","pricing","totals","timeSeries","customers","models","customersTruncated","modelsTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/encryption-metrics":{"get":{"operationId":"getProjectEncryptionUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getEncryptionUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Encryption Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","bucket"]}},"operations":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"operation":{"type":"string","enum":["encrypt","decrypt"]}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","operation"]}}},"required":["status","range","totals","timeSeries","operations"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/sandbox-metrics":{"get":{"operationId":"getProjectSandboxMetrics","x-speakeasy-group":"projects","x-speakeasy-name-override":"getSandboxMetrics","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Sandbox Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"externalId":{"type":"string","nullable":true},"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"lastSeenAt":{"type":"string","format":"date-time"}},"required":["deploymentGroupId","externalId","sessions","commands","lastSeenAt"]}},"customersTruncated":{"type":"boolean"}},"required":["status","range","totals","timeSeries","customers","customersTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups":{"post":{"operationId":"createDeploymentGroup","tags":["deployment-groups"],"summary":"Create a new deployment group","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group with this name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentGroups","tags":["deployment-groups"],"summary":"List deployment groups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of deployment groups","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"}}}]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-name":{"put":{"operationId":"ensureDeploymentGroupByName","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and name","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByNameRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-external-id":{"put":{"operationId":"ensureDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Optional for project-scoped API keys."},"required":false,"description":"Project ID or name. Optional for project-scoped API keys.","name":"project","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"required":true,"description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","name":"externalId","in":"query"}],"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project or deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/setup-links":{"post":{"operationId":"createSetupLink","tags":["setup-links"],"summary":"Create a customer setup link","description":"Ensures the Deployment Group identified by Project and external ID, then creates a group-scoped setup link with exact captured sources.","x-speakeasy-group":"setupLinks","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkRequest"}}}},"responses":{"200":{"description":"Customer environment ensured and setup link created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkResponse"}}}},"400":{"description":"Customer environment or setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Customer environment name or setup source conflicts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}":{"get":{"operationId":"getDeploymentGroup","tags":["deployment-groups"],"summary":"Get deployment group details","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"}],"responses":{"200":{"description":"Deployment group details","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"deploymentCount":{"type":"integer","description":"Current number of deployments in this deployment group"}},"required":["deploymentCount"]}]}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentGroup","tags":["deployment-groups"],"summary":"Update deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDeploymentGroup","tags":["deployment-groups"],"summary":"Delete deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Deployment group deleted successfully"},"400":{"description":"Cannot delete deployment group that has deployments","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/external-id":{"put":{"operationId":"setDeploymentGroupExternalId","tags":["deployment-groups"],"summary":"Set or clear a deployment group's external ID","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetDeploymentGroupExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group external ID updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group external ID already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/tokens":{"post":{"operationId":"createDeploymentGroupToken","tags":["deployment-groups"],"summary":"Create deployment group token","description":"Creates a deployment-group scoped API key and returns both the token and formatted deployment link","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenRequest"}}}},"responses":{"200":{"description":"Deployment group token created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"}}}},"400":{"description":"Deployment setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The project's sandbox configuration changed concurrently; retry the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/first-party-session":{"post":{"operationId":"createFirstPartyDeploymentSession","tags":["deployment-groups"],"summary":"Create first-party deployment session","description":"Mints a short-lived deployment-group token with the recommended self-deploy policy for the authenticated developer.","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"First-party deployment session created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateFirstPartyDeploymentSessionResponse"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external":{"get":{"operationId":"getExternalAIBinding","tags":["deployment-groups"],"summary":"Get external AI connection state","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"External AI connection state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBindingState"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putExternalAIBinding","tags":["deployment-groups"],"summary":"Connect or rotate an external AI provider key","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutExternalAIBindingRequest"}}}},"responses":{"202":{"description":"External AI connection stored and queued for checking","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBinding"}}}},"400":{"description":"The key is not valid for the selected provider","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The group already has an active cloud AI source","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Provider verification is temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteExternalAIBinding","tags":["deployment-groups"],"summary":"Revoke the external AI connection","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"External AI connection revoked"},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/models/{publicModelId}/checks":{"post":{"operationId":"createExternalAIModelCheck","tags":["deployment-groups"],"summary":"Queue an explicit external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":256},"required":true,"name":"publicModelId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"The potentially billable model check was queued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"400":{"description":"The model is not configured for this project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or binding not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/model-checks/{checkId}":{"get":{"operationId":"getExternalAIModelCheck","tags":["deployment-groups"],"summary":"Get an external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"checkId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Model check state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or check not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry":{"get":{"operationId":"getContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Container registry state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryState"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1,"maxLength":128}},"required":["deploymentId","resourceId"]}}}},"responses":{"200":{"description":"Registry route","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories":{"post":{"operationId":"createContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"}},"required":["name"]}}}},"responses":{"201":{"description":"Repository requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials":{"post":{"operationId":"createContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":64},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"minItems":1,"maxItems":100},"expiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["label","scope"]}}}},"responses":{"201":{"description":"Credential created; password is returned once","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateContainerRegistryCredentialResponse"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials/{credentialId}":{"delete":{"operationId":"revokeContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"required":true,"description":"Unique identifier for the container registry credential.","name":"credentialId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Credential revoked"},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories/{repositoryId}":{"delete":{"operationId":"deleteContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"required":true,"description":"Unique identifier for the container registry repository.","name":"repositoryId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"confirmName":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"disposition":{"type":"string","enum":["preserve","deleteContents"]}},"required":["confirmName","disposition"]}}}},"responses":{"202":{"description":"Repository deletion requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/verify":{"post":{"operationId":"verifyContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Verification requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/revoke":{"post":{"operationId":"revokeContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Registry revocation requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages":{"get":{"operationId":"listPackages","description":"List packages with optional filters. Returns packages ordered by creation date (newest first).","x-speakeasy-group":"packages","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Filter by package type"},"required":false,"description":"Filter by package type","name":"type","in":"query"},{"schema":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Filter by package status"},"required":false,"description":"Filter by package status","name":"status","in":"query"},{"schema":{"type":"string","pattern":"^rel_[0-9a-zA-Z]{28}$","description":"Filter by source release"},"required":false,"description":"Filter by source release","name":"sourceReleaseId","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search packages by type or version"},"required":false,"description":"Search packages by type or version","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of packages.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Package"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}":{"get":{"operationId":"getPackage","description":"Get details of a specific package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/rebuild":{"post":{"operationId":"rebuildPackages","description":"Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.","x-speakeasy-group":"packages","x-speakeasy-name-override":"rebuild","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to rebuild packages for"}},"required":["project"]}}}},"responses":{"200":{"description":"Packages rebuilt successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"packagesCreated":{"type":"integer","description":"Number of packages created"}},"required":["packagesCreated"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle the release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}/cancel":{"post":{"operationId":"cancelPackage","description":"Cancel a pending or building package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"cancel","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package canceled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"400":{"description":"Package cannot be canceled (not in pending or building status).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases":{"get":{"operationId":"listReleases","description":"Retrieve all releases.","x-speakeasy-group":"releases","x-speakeasy-name-override":"list","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","description":"Filter to releases promoted to this channel. Defaults to production."},"required":false,"description":"Filter to releases promoted to this channel. Defaults to production.","name":"channel","in":"query"},{"schema":{"type":"string","enum":["true","false"],"default":"false"},"required":false,"name":"allChannels","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search releases by commit message, branch, SHA, or release ID"},"required":false,"description":"Search releases by commit message, branch, SHA, or release ID","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by git branch (commitRef)"},"required":false,"description":"Filter by git branch (commitRef)","name":"branch","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by commit author login or name"},"required":false,"description":"Filter by commit author login or name","name":"author","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created after this date (ISO 8601)"},"required":false,"description":"Filter releases created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created before this date (ISO 8601)"},"required":false,"description":"Filter releases created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved releases.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createRelease","description":"Create a new release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateReleaseRequest"}}}},"responses":{"201":{"description":"Release created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Release"}}}},"400":{"description":"Invalid release request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/branches":{"get":{"operationId":"listReleaseBranches","description":"List distinct git branches across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listBranches","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search branches by name (case-insensitive contains)"},"required":false,"description":"Search branches by name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of branches to return"},"required":false,"description":"Maximum number of branches to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct branches.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/authors":{"get":{"operationId":"listReleaseAuthors","description":"List distinct commit authors across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listAuthors","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search authors by login or name (case-insensitive contains)"},"required":false,"description":"Search authors by login or name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of authors to return"},"required":false,"description":"Maximum number of authors to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct authors.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseAuthorFilterItem"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}":{"get":{"operationId":"getRelease","description":"Retrieve a release by ID.","x-speakeasy-group":"releases","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseListItemResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}/deployments":{"get":{"operationId":"listReleaseDeployments","description":"List the project's deployments with their rollout state relative to this release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseRolloutState"},"description":"Filter deployments by rollout state"},"required":false,"description":"Filter deployments by rollout state","name":"state","in":"query"},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved release deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseDeploymentsResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels":{"get":{"operationId":"listReleaseChannels","summary":"List release channels","description":"List the release channels configured for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Project release channels.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannel"}}},"required":["items"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createReleaseChannel","summary":"Create a release channel","description":"Create a release channel for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["name"],"additionalProperties":false}}}},"responses":{"201":{"description":"Channel created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"400":{"description":"Invalid release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}/promote":{"post":{"operationId":"promoteRelease","x-speakeasy-group":"releases","x-speakeasy-name-override":"promote","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"expectedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["releaseId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Release promoted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"404":{"description":"Project, channel, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel changed concurrently, or the sandbox bundle its release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}":{"delete":{"operationId":"deleteReleaseChannel","summary":"Delete a release channel","description":"Delete a release channel from a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"204":{"description":"Channel deleted."},"400":{"description":"Reserved channel.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel is still followed by deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments":{"get":{"operationId":"listDeployments","description":"Retrieve all deployments.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"list","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Filter by exact deployment name. Must be used with deploymentGroup."},"required":false,"description":"Filter by exact deployment name. Must be used with deploymentGroup.","name":"name","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name, public subdomain, or deployment group name"},"required":false,"description":"Search deployments by name, public subdomain, or deployment group name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved deployments.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid deployment list filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDeployment","description":"Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewDeploymentRequest"}}}},"responses":{"200":{"description":"Existing deployment returned for idempotent deployment-group registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"201":{"description":"Deployment created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"400":{"description":"Bad request - deployment group has reached max deployments limit.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden - insufficient permissions to create deployments in this context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment group not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/stats":{"get":{"operationId":"getDeploymentStats","description":"Get aggregated deployment statistics. Returns total count and breakdown by status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getStats","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name or deployment group name"},"required":false,"description":"Search deployments by name or deployment group name","name":"search","in":"query"}],"responses":{"200":{"description":"Deployment statistics retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentStats"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-environments":{"get":{"operationId":"listDeploymentFilterEnvironments","description":"List distinct effective environments used by deployments. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterEnvironments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Distinct environments retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-deployment-groups":{"get":{"operationId":"listDeploymentFilterDeploymentGroups","description":"List deployment groups with deployment counts. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterDeploymentGroups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return"},"required":false,"description":"Maximum number of items to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Deployment groups for filter retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"deploymentCount":{"type":"number"},"runningCount":{"type":"number","description":"Number of deployments in 'running' status"},"failedCount":{"type":"number","description":"Number of deployments in a failed status"},"inProgressCount":{"type":"number","description":"Number of deployments in an in-progress status (provisioning, updating, etc.)"}},"required":["id","name","deploymentCount","runningCount","failedCount","inProgressCount"]}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}":{"get":{"operationId":"getDeployment","description":"Retrieve a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentDetailResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/update-operations/{operationId}":{"get":{"operationId":"getDeploymentUpdateOperation","description":"Retrieve a deployment update operation by its durable operation ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getUpdateOperation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"required":true,"description":"Unique identifier for the deployment update operation.","name":"operationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment update operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}}}},"403":{"description":"The credential cannot read this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or update operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/info":{"get":{"operationId":"getDeploymentConnectionInfo","description":"Get deployment connection information including command endpoint and resource URLs.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment connection information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentConnectionInfo"}}}},"400":{"description":"Deployment not ready (no manager assigned).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/import":{"post":{"operationId":"importDeployment","description":"Import a deployment from resolved setup infrastructure such as CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"import","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportDeploymentRequest"}}}},"responses":{"200":{"description":"Deployment import was idempotent and returned an existing deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"201":{"description":"Deployment imported and created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/first-party-inputs":{"put":{"operationId":"setFirstPartyDeploymentInputs","description":"Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setFirstPartyDeploymentInputs","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Input values stored on the session token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsResponse"}}}},"400":{"description":"A deployment-group token scope is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The token is not a first-party deployment session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The requested release channel does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to store input values.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations":{"post":{"operationId":"createSetupRegistrationOperation","description":"Start a durable setup registration operation for CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createSetupRegistrationOperation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupRegistrationOperationRequest"}}}},"responses":{"202":{"description":"Setup registration operation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"400":{"description":"Invalid setup registration operation request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The credential cannot manage this setup registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed before callback acceptance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations/{id}":{"get":{"operationId":"getSetupRegistrationOperation","description":"Get setup registration operation status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getSetupRegistrationOperation","parameters":[{"schema":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"required":true,"description":"Unique identifier for the setup registration operation.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Setup registration operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"403":{"description":"The credential cannot read this setup registration result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Setup registration operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/delete":{"post":{"operationId":"deleteDeployment","description":"Delete, detach, or forget a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentRequest"}}}},"responses":{"202":{"description":"Deployment deletion request accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentResponse"}}}},"400":{"description":"Cannot delete the deployment in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/redeploy":{"post":{"operationId":"redeployDeployment","description":"Redeploy a running deployment with the same release and fresh environment variables. Sets status to update-pending.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"redeploy","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment redeployment triggered successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["message","operation"]}}}},"400":{"description":"Cannot redeploy - deployment must be running.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/pin-release":{"post":{"operationId":"pinDeploymentRelease","description":"Pin or unpin a running or runtime-failed deployment. Running deployments start an update; failed deployments retry toward the selected release.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"pinRelease","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PinReleaseRequest"}}}},"responses":{"202":{"description":"Release pin updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot pin release from the deployment's current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/release-channel":{"post":{"operationId":"setDeploymentReleaseChannel","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setReleaseChannel","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"channel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["channel"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployment release channel updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"400":{"description":"Channel release is unavailable for the deployment platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/retry":{"post":{"operationId":"retryDeployment","description":"Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"retry","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment retry enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Deployment is not in a failed state that can be retried.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment retry conflicts with current execution state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/inputs":{"get":{"operationId":"getDeploymentInputs","description":"Get the active input definitions and current non-secret values for a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment inputs returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInputsResponse"}}}},"403":{"description":"Insufficient permission to read deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentInputs","description":"Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Deployment inputs saved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsResponse"}}}},"400":{"description":"Input values are invalid for the deployment release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, project, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/compute":{"patch":{"operationId":"updateDeploymentCompute","description":"Update deployment-time compute pool selections and request reconciliation by the hosted manager.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateCompute","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentComputeRequest"}}}},"responses":{"200":{"description":"Compute settings saved or already current.","content":{"application/json":{"schema":{"type":"object","properties":{"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["outcome","operation"]}}}},"400":{"description":"Compute settings cannot be changed from the current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update compute settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/environment-variables":{"patch":{"operationId":"updateDeploymentEnvironmentVariables","description":"Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateEnvironmentVariables","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentEnvironmentVariablesRequest"}}}},"responses":{"202":{"description":"Environment variables updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Environment variables are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update environment variables.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/token":{"post":{"operationId":"createDeploymentToken","description":"Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenRequest"}}}},"responses":{"201":{"description":"Deployment token created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenResponse"}}}},"403":{"description":"Forbidden - insufficient permissions to issue a deployment token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}":{"put":{"operationId":"putDynamicContainer","description":"Create or replace a dynamic container in an existing deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"put","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string"},"required":false,"name":"if-match","in":"header"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutDynamicContainerRequest"}}}},"responses":{"202":{"description":"Desired state saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Generation conflict.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"501":{"description":"This deployment does not support dynamic containers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDynamicContainer","description":"Get one dynamic container's desired generation, status, and internal address.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic container.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDynamicContainer","description":"Remove a dynamic container from this deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"deleted":{"type":"boolean","enum":[true]}},"required":["name","deleted"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers":{"get":{"operationId":"listDynamicContainers","description":"List containers created after this deployment was installed.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic containers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}/logs":{"get":{"operationId":"getDynamicContainerLogs","description":"Read recent logs for one dynamic container.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"logs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":10080,"default":60},"required":false,"name":"sinceMinutes","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":200,"default":100},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"}],"responses":{"200":{"description":"Container logs.","content":{"application/json":{"schema":{"type":"object","properties":{"logs":{"type":"array","items":{"type":"object","properties":{"timestamp":{"type":"string","format":"date-time"},"level":{"type":"string"},"message":{"type":"string"},"replicaId":{"type":"string","nullable":true}},"required":["timestamp","level","message","replicaId"]}},"numHits":{"type":"number"},"nextCursor":{"type":"string","nullable":true},"partial":{"type":"boolean"},"errorCount":{"type":"number"}},"required":["logs","numHits","nextCursor","partial","errorCount"]}}}},"400":{"description":"Invalid cursor or time range.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Logs are unavailable for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/machines":{"get":{"operationId":"listDeploymentMachines","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listMachines","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines in every Horizon-backed ComputeCluster for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListDeploymentMachinesResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Horizon inventory could not be read.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation":{"get":{"operationId":"getDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current non-secret rotation state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationStatus"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"prepareDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"expectedRevision":{"type":"integer","minimum":0,"maximum":2147483644}},"required":["expectedRevision"],"additionalProperties":false}}}},"responses":{"200":{"description":"Prepared or replayed rotation; download values explicitly","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/cancel":{"post":{"operationId":"cancelDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Cancelled; apply the newer rollback values to restore the old credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/values":{"post":{"operationId":"getDeploymentCredentialRotationValues","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Secret values for this exact current rotation. Never persist in browser storage.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationValues"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/volume-restores":{"post":{"operationId":"createDeploymentVolumeRestore","description":"Replace one replica's persistent volume with a new volume made from a snapshot. The deployment must be running (an update may already be queued or in progress). The replica is stopped while its volume is swapped, and the replaced volume is snapshotted before it is deleted.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"restoreVolume","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateVolumeRestoreRequest"}}}},"responses":{"202":{"description":"Volume restore requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VolumeRestore"}}}},"400":{"description":"The deployment is not running, or the resource has no persistent volume for this replica.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A restore of this volume is already pending.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentVolumeRestores","description":"List a deployment's volume restore requests, newest first.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listVolumeRestores","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Volume restore requests.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListVolumeRestoresResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/volume-restores/{requestId}":{"delete":{"operationId":"cancelDeploymentVolumeRestore","description":"Cancel a pending volume restore. Use it when a restore keeps failing: the deployment stops attempting it. A restore whose volume was already swapped still finishes. Allowed in any deployment status, including update-failed.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"cancelVolumeRestore","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"vrst_[0-9a-z]{28}$","description":"Unique identifier for the volume restore.","example":"vrst_rs1j4dytswpy7wbc819jdcx"},"required":true,"description":"Unique identifier for the volume restore.","name":"requestId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Volume restore cancelled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VolumeRestore"}}}},"400":{"description":"The deployment has no deployed release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or volume restore not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The volume restore already completed or was cancelled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers":{"post":{"operationId":"createManager","description":"Create a new manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewManagerRequest"}}}},"responses":{"201":{"description":"Manager created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Invalid private manager setup method.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A manager for this target already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listManagers","description":"Retrieve all managers.","x-speakeasy-group":"managers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search managers by name"},"required":false,"description":"Search managers by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of managers to return"},"required":false,"description":"Maximum number of managers to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved managers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Manager"}}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/setup-token":{"post":{"operationId":"retryManagerSetup","description":"Revoke previous private-manager setup tokens and issue a fresh setup token/config.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retrySetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"201":{"description":"Fresh manager setup token generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Manager setup cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or setup config not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/retry":{"post":{"operationId":"retryManager","description":"Retry private-manager setup. Returns a fresh setup action before the internal deployment exists, or requests retry for the internal deployment after it exists.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retry","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager retry handled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerRetryResponse"}}}},"400":{"description":"Manager cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or internal deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/cancel-setup":{"post":{"operationId":"cancelManagerSetup","description":"Cancel pending private-manager setup, revoke setup/runtime tokens, and remove the undeployed manager record.","x-speakeasy-group":"managers","x-speakeasy-name-override":"cancelSetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager setup canceled successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Manager setup cannot be canceled in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}":{"get":{"operationId":"getManager","description":"Retrieve a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"get","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Manager"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteManager","description":"Delete a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager deletion enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot delete the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Internal deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/domain-binding":{"get":{"operationId":"getManagerDomainBinding","description":"Get the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager domain binding.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateManagerDomainBinding","description":"Create, update, or remove the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"updateDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerDomainBinding"}}}},"responses":{"200":{"description":"Manager domain binding updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"400":{"description":"Invalid domain binding request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or domain not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/management-config":{"get":{"operationId":"getManagerManagementConfig","description":"Get the management configuration for a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getManagementConfig","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":true,"description":"Represents the target cloud platform.","name":"platform","in":"query"}],"responses":{"200":{"description":"Management config retrieved successfully.","content":{"application/json":{"schema":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/provision":{"post":{"operationId":"provisionManager","description":"Enqueue provisioning for a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"provision","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager provisioning enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot provision the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/update":{"post":{"operationId":"updateManager","description":"Update a manager to a specific release ID or active release.","x-speakeasy-group":"managers","x-speakeasy-name-override":"update","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerRequest"}}}},"responses":{"202":{"description":"Manager update enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot update the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/events":{"get":{"operationId":"listManagerEvents","description":"Retrieve all events of a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"listEvents","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Event"}}},"required":["items"]}}}},"400":{"description":"Manager does not expose user-accessible events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/token":{"post":{"operationId":"generateManagerToken","description":"Generate a short-lived JWT for direct browser → manager communication. Used for fetching command payloads and querying logs without routing sensitive data through the platform API.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenRequest"}}}},"responses":{"200":{"description":"Manager access token and connection info.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/binding-token":{"post":{"operationId":"generateManagerBindingToken","description":"Generate a short-lived deployment-scoped token for resolving opted-in remote bindings through the currently assigned manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerBindingToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenRequest"}}}},"responses":{"200":{"description":"Remote Bindings token and assigned manager URL.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenResponse"}}}},"403":{"description":"The caller cannot access Remote Bindings for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Assigned manager or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A sandbox token was requested but the deployment's current release publishes no remote sandbox, or more than one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed, such as an unknown binding kind.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/gcp-oauth-provider/resolve":{"post":{"operationId":"resolveManagerGcpOAuthProvider","description":"Resolve decrypted project-level Google Cloud OAuth provider settings for a manager-side deployment bootstrap.","x-speakeasy-group":"managers","x-speakeasy-name-override":"resolveGcpOAuthProvider","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderRequest"}}}},"responses":{"200":{"description":"Resolved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderResponse"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Manager cannot resolve this deployment group's project settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/heartbeat":{"post":{"operationId":"reportManagerHeartbeat","description":"Report Manager health status and metrics.","x-speakeasy-group":"managers","x-speakeasy-name-override":"reportHeartbeat","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatRequest"}}}},"responses":{"200":{"description":"Heartbeat acknowledged.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/deployment":{"get":{"operationId":"getManagerDeployment","description":"Get deployment details for a private manager (internal deployment platform, status, resources).","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDeployment","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager deployment details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDeployment"}}}},"404":{"description":"Manager not found or has no internal deployment (alien-hosted managers don't have deployment info).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/snapshot":{"get":{"operationId":"getContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"responses":{"200":{"description":"Complete desired registry snapshot assigned to this Manager","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryManagerSnapshot"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/applied":{"post":{"operationId":"applyContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"routeId":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"desiredRevision":{"type":"integer","minimum":0},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"status":{"type":"string","enum":["ready","deleted","failed"]},"routableUpstreamName":{"type":"string","nullable":true,"minLength":1},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["id","status","routableUpstreamName","error"],"additionalProperties":false}},"verification":{"type":"object","nullable":true,"properties":{"succeeded":{"type":"boolean"},"observedAt":{"type":"string","format":"date-time"},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["succeeded","observedAt","error"],"additionalProperties":false}},"required":["routeId","desiredRevision","repositories","verification"],"additionalProperties":false}}}},"responses":{"200":{"description":"Applied registry snapshot revision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplyContainerRegistrySnapshotResponse"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/prepare":{"post":{"operationId":"prepareOperatorManifestPackage","tags":["operator-manifests"],"summary":"Prepare the white-labeled Operator image for an Operate install","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageRequest"}}}},"responses":{"200":{"description":"Operator image package created or reused.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/render":{"post":{"operationId":"renderOperatorManifest","tags":["operator-manifests"],"summary":"Render a Kubernetes Operator manifest","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestRequest"}}}},"responses":{"200":{"description":"Operator manifest rendered successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestResponse"}}}},"400":{"description":"An enabled custom plugin has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Operator image package is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid platform or manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/bootstrap-write-check":{"post":{"operationId":"checkEcsBootstrapWrite","tags":["operator-manifests"],"description":"Checks a Remote Operator setup token and its exact AWS target before the local bootstrap command writes a registration secret. A registered stack cannot use this path.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EcsBootstrapWriteCheckRequest"}}}},"responses":{"204":{"description":"The setup token may write the bootstrap secret."},"400":{"description":"The AWS target is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"The setup token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The setup token cannot read this deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The setup token does not match the target or the stack has registered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/render":{"post":{"operationId":"renderOperatorEcsCloudFormation","tags":["operator-manifests"],"summary":"Render a Remote Operator ECS Fargate CloudFormation installer","description":"Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from the project's enabled operations; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationRequest"}}}},"responses":{"200":{"description":"CloudFormation installer rendered, or null template and deployCommand while imagePending is true.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationResponse"}}}},"400":{"description":"Enabled AWS permissions cannot be safely compiled or directly deployed with the supplied resource ceilings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not authorized to update the project or use the selected Operator image package.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Operator image package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The selected Operator image package is unavailable, or the registered stack belongs to a different ECS cluster.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request body validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid Operator image or AWS manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys":{"get":{"operationId":"listAPIKeys","description":"Retrieve all API keys for the current workspace.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved API keys.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/APIKey"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAPIKey","description":"Create a new API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyRequest"}}}},"responses":{"201":{"description":"API key created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyResponse"}}}},"403":{"description":"Insufficient permissions to create API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/{id}":{"get":{"operationId":"getAPIKey","description":"Retrieve a specific API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateAPIKey","description":"Update an API key (enable/disable, change description).","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateAPIKeyRequest"}}}},"responses":{"200":{"description":"API key updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeAPIKey","description":"Revoke (soft delete) an API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"revoke","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"API key revoked successfully."},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/batch-delete":{"post":{"operationId":"deleteAPIKeys","description":"Permanently delete multiple API keys.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"deleteMultiple","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteAPIKeysRequest"}}}},"responses":{"200":{"description":"API keys deleted successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"deletedCount":{"type":"number"}},"required":["deletedCount"]}}}},"403":{"description":"Insufficient permissions to delete API keys.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains":{"get":{"operationId":"listDomains","description":"List system domains and workspace domains.","x-speakeasy-group":"domains","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domains.","content":{"application/json":{"schema":{"type":"object","properties":{"domains":{"type":"array","items":{"$ref":"#/components/schemas/DomainWithUsage"}}},"required":["domains"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDomain","description":"Create a workspace domain and optional initial endpoints.","x-speakeasy-group":"domains","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"setup":{"type":"object","properties":{"deploymentPortal":{"type":"boolean"},"packages":{"type":"boolean"},"deploymentUrlProjectId":{"type":"string","nullable":true,"pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"managerIds":{"type":"array","items":{"type":"string"}}}}},"required":["domain"]}}}},"responses":{"200":{"description":"Returned an existing workspace domain claim.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"201":{"description":"Created domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Domain is reserved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/endpoints":{"post":{"operationId":"createDomainEndpoint","description":"Create an endpoint under a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"createEndpoint","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"owner":{"type":"object","properties":{"type":{"type":"string","enum":["workspace","project","manager"]},"id":{"type":"string"}},"required":["type","id"]}},"required":["kind"]}}}},"responses":{"201":{"description":"Created endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Bad request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Endpoint cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}":{"get":{"operationId":"getDomain","description":"Get domain by ID.","x-speakeasy-group":"domains","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDomain","description":"Delete a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}},"required":["success"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain is in use.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/refresh":{"post":{"operationId":"refreshDomain","description":"Refresh workspace domain verification.","x-speakeasy-group":"domains","x-speakeasy-name-override":"refresh","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain verification refresh requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events":{"get":{"operationId":"listEvents","description":"Retrieve all events.","x-speakeasy-group":"events","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter events to a single deployment."},"required":false,"description":"Filter events to a single deployment.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Filter events to a single release."},"required":false,"description":"Filter events to a single release.","name":"releaseId","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["releaseCreatedAt"]},"description":"Optional fields to include: releaseCreatedAt"},"required":false,"description":"Optional fields to include: releaseCreatedAt","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/EventListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events/{id}":{"get":{"operationId":"getEvent","description":"Retrieve an event by ID.","x-speakeasy-group":"events","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"required":true,"description":"Unique identifier for the event.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved event.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Event"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents":{"get":{"operationId":"listIncidents","description":"List authorized incidents without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string"},"required":false,"name":"projectId","in":"query"},{"schema":{"type":"string","enum":["queued","running","halted","complete","error","canceled"]},"required":false,"name":"status","in":"query"},{"schema":{"type":"string","maxLength":256},"required":false,"name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":25},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incidents.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentListResponse"}}}},"400":{"description":"Invalid request or cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents/{id}":{"get":{"operationId":"getIncident","description":"Get an authorized incident without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incident.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Incident not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens":{"get":{"operationId":"listMachinesJoinTokens","x-speakeasy-group":"machines","x-speakeasy-name-override":"listJoinTokens","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Join tokens for a Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMachinesJoinTokensResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"createJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Newly minted Machines join token. Existing tokens keep working; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/rotate":{"post":{"operationId":"rotateMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"rotateJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Rotated Machines join token. Revokes all existing tokens, then mints a new one; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/{tokenId}":{"delete":{"operationId":"revokeMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"revokeJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"tokenId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines join token revocation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}/drain":{"delete":{"operationId":"cancelMachinesMachineDrain","x-speakeasy-group":"machines","x-speakeasy-name-override":"cancelMachineDrain","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines drain cancellation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelMachinesMachineDrainResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"drainMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"drainMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineRequest"}}}},"responses":{"200":{"description":"Machines drain request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}":{"delete":{"operationId":"removeMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"removeMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines remove request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoveMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/bootstrap":{"post":{"operationId":"bootstrapCommands","description":"Resolve a deployment's current manager and mint a five-minute command capability. Sender tokens can dispatch and observe commands only for this deployment. Receiver tokens can lease and complete commands only for the resolved Container or Daemon target.","x-speakeasy-group":"commands","x-speakeasy-name-override":"bootstrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapRequest"}}}},"responses":{"200":{"description":"Manager connection details and a short-lived command capability.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapResponse"}}}},"400":{"description":"Invalid request or deployment state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot operate this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, manager, or receiver target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The selected resource cannot run an external receiver.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands":{"get":{"operationId":"listCommands","description":"Retrieve commands. Use for dashboard analytics and command history.","x-speakeasy-group":"commands","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Filter by command state"},"required":false,"description":"Filter by command state","name":"state","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Filter by command name"},"required":false,"description":"Filter by command name","name":"name","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search commands by name"},"required":false,"description":"Search commands by name","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created after this date (ISO 8601)"},"required":false,"description":"Filter commands created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created before this date (ISO 8601)"},"required":false,"description":"Filter commands created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deployment","project"]},"description":"Optional fields to include: deployment, project"},"required":false,"description":"Optional fields to include: deployment, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved commands.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/CommandListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createCommand","description":"Create command metadata. Called by manager when processing commands. Returns project info for routing decisions.","x-speakeasy-group":"commands","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandRequest"}}}},"responses":{"201":{"description":"Command created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandResponse"}}}},"400":{"description":"Deployment is not ready or has no assigned manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The operation access request is no longer approved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The deployment manager is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/names":{"get":{"operationId":"listCommandNames","description":"List distinct command names. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listNames","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search command names (prefix match)"},"required":false,"description":"Search command names (prefix match)","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct command names.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandNamesResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/deployments":{"get":{"operationId":"listCommandDeployments","description":"List distinct deployments that have commands, including deployment group info. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search deployment or deployment group names"},"required":false,"description":"Search deployment or deployment group names","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct deployments that have commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandDeploymentsResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/target":{"get":{"operationId":"resolveCommandTarget","description":"Resolve which resource a command for this deployment would be addressed to, and how it would be delivered. Fails when the deployment has no command-capable resources, or more than one and no explicit target was named.","x-speakeasy-group":"commands","x-speakeasy-name-override":"resolveTarget","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment to resolve the target for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Deployment to resolve the target for","name":"deploymentId","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Explicit resource id to resolve; must be a command-capable resource"},"required":false,"description":"Explicit resource id to resolve; must be a command-capable resource","name":"target","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":255,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead."},"required":false,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead.","name":"command","in":"query"}],"responses":{"200":{"description":"Resolved command target.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolvedCommandTarget"}}}},"404":{"description":"Deployment or target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}":{"patch":{"operationId":"updateCommand","description":"Update command state. Called by manager when command is dispatched or completes.","x-speakeasy-group":"commands","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateCommandRequest"}}}},"responses":{"200":{"description":"Command updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getCommand","description":"Retrieve a command by ID.","x-speakeasy-group":"commands","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["true"],"description":"Explicitly confirm access to an operation result marked sensitive."},"required":false,"description":"Explicitly confirm access to an operation result marked sensitive.","name":"confirmSensitiveOutput","in":"query"}],"responses":{"200":{"description":"Retrieved command.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid operation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/dispatch":{"post":{"operationId":"dispatchCommand","description":"Atomically mark a command DISPATCHED unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"dispatch","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandRequest"}}}},"responses":{"200":{"description":"Dispatch attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/complete":{"post":{"operationId":"completeCommand","description":"Atomically transition a command to a terminal state (SUCCEEDED, FAILED, or EXPIRED) unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"complete","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandRequest"}}}},"responses":{"200":{"description":"Completion attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/increment-attempt":{"post":{"operationId":"incrementCommandAttempt","description":"Atomically increment the command's attempt counter and return the new value.","x-speakeasy-group":"commands","x-speakeasy-name-override":"incrementAttempt","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Attempt incremented.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncrementCommandAttemptResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions":{"get":{"operationId":"listDebugSessions","description":"Retrieve debug sessions for dashboard audit. Filters: project, deployment, state, mode.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Filter by session state"}]},"required":false,"description":"Filter by session state","name":"state","in":"query"},{"schema":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model (push/pull). Joins against the parent deployment."},"required":false,"description":"Filter by deployment model (push/pull). Joins against the parent deployment.","name":"mode","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Filter by cloud provider. Joins against the parent deployment."},"required":false,"description":"Filter by cloud provider. Joins against the parent deployment.","name":"provider","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Paginated debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSessionListResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDebugSession","description":"Create a debug-session audit row. Called by the manager when a pull or push debug tunnel is opened. Workspace + project derived from deployment.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDebugSessionRequest"}}}},"responses":{"201":{"description":"Debug session created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Deployment or access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions/{id}":{"patch":{"operationId":"updateDebugSession","description":"Update debug-session state. Called by manager on tunnel attach, close, or deadline expiry.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDebugSessionRequest"}}}},"responses":{"200":{"description":"Debug session updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Debug session not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDebugSession","description":"Retrieve a debug session by ID.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved debug session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info":{"get":{"operationId":"getDeploymentInfo","description":"Get deployment information for the deployment portal. Accepts both deployment-scoped and deployment-group-scoped API keys. Returns project information, package status/outputs, and either deployment or deployment group details depending on the token type. Poll this endpoint to check if packages are ready.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":false,"description":"Represents the target cloud platform.","name":"platform","in":"query"},{"schema":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":false,"name":"setupItem","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"updateOperationId","in":"query"}],"responses":{"200":{"description":"Deployment information retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInfo"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-scoped or deployment-group-scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/compute-plan":{"post":{"operationId":"planDeploymentCompute","description":"Plan deployment compute for the active release before stack preparation. The response contains recommended machine and scale choices for cloud compute pools.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"planCompute","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Compute plan returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentComputePlan"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/prepare-stack":{"post":{"operationId":"prepareDeploymentStack","description":"Prepare the active release stack for a deployment portal setup session. The response contains the generated stack shape plus setup compatibility metadata.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"prepareStack","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"saveForSetup":{"type":"boolean","description":"Persist validated choices for the exact blocked update; does not apply cloud changes."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Prepared stack returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PreparedDeploymentStack"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/install-url":{"post":{"operationId":"slackIntegrationInstallUrl","description":"Generate the Slack OAuth consent URL for this workspace.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"installUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"OAuth URL the dashboard should redirect the user to.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackInstallUrlResponse"}}}},"500":{"description":"Server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/status":{"get":{"operationId":"slackIntegrationStatus","description":"Return the Slack install for this workspace (if any).","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"status","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackIntegrationStatus"}}}}}}},"/v1/integrations/slack/channels":{"get":{"operationId":"slackIntegrationChannels","description":"List public Slack channels for this workspace's install. Used by the dashboard's notification-channel picker.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"listChannels","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Public channels.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackChannelsResponse"}}}},"400":{"description":"Workspace not connected to Slack.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/notification-channel":{"put":{"operationId":"slackIntegrationSetNotificationChannel","description":"Configure which Slack channel receives ai-agent monitor reports.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"setNotificationChannel","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelRequest"}}}},"responses":{"200":{"description":"Channel saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelResponse"}}}},"400":{"description":"Not connected, or join failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/installation":{"delete":{"operationId":"slackIntegrationUninstall","description":"Uninstall the Slack integration for this workspace. Revokes the bot token at Slack and deletes the row.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"uninstall","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Uninstalled."}}}},"/v1/agent-sessions":{"get":{"operationId":"listAgentSessions","description":"List ai-agent monitor sessions for this workspace, or for one project. Newest first, capped at 50.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},{"description":"Only sessions bound to this project. Omit to list the whole workspace."}]},"required":false,"description":"Only sessions bound to this project. Omit to list the whole workspace.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionListResponse"}}}}}}},"/v1/agent-sessions/{id}":{"get":{"operationId":"getAgentSession","description":"Retrieve one ai-agent monitor session by id.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionDetail"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/events":{"get":{"operationId":"listAgentSessionEvents","description":"Incrementally read a session's event log (steps, tool calls, report deltas, approvals, status transitions). Pass the previous response's `latestSeq` as `after` to fetch only new events.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"events","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","nullable":true,"minimum":0,"default":0},"required":false,"name":"after","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":500,"default":200},"required":false,"name":"limit","in":"query"}],"responses":{"200":{"description":"Events after the cursor, oldest first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionEventsResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/stop":{"post":{"operationId":"stopAgentSession","description":"Stop (cancel) a running or queued ai-agent monitor session. Proxies to the ai-agent service, minting a fresh CLI session for the caller so the ai-agent's own auth applies. Idempotent — stopping an already-terminal session is a 200 no-op.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"stop","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Already terminal / no-op.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"202":{"description":"Cancel accepted; session stopped.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"AI agent service is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins":{"get":{"operationId":"listOperationsPlugins","description":"List available operations plugins (builtin + custom) for a project, with their operations and risk tiers.","x-speakeasy-group":"operations","x-speakeasy-name-override":"listPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The operations plugin catalog.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListOperationsPluginsResponse"}}}},"409":{"description":"A persisted custom plugin has invalid metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"publishOperationsPlugin","description":"Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"publishPlugin","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginRequest"}}}},"responses":{"201":{"description":"The plugin was published, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginResponse"}}}},"400":{"description":"Invalid metadata, or no bundle was uploaded for this name/version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A plugin with this name is already published at this version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/builtin/enabled":{"put":{"operationId":"setBuiltinOperationsPlugins","description":"Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setBuiltinPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsRequest"}}}},"responses":{"200":{"description":"The enabled built-in plugin set was replaced, with the cloud permission delta.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsResponse"}}}},"400":{"description":"One or more plugin names are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/upload-url":{"post":{"operationId":"createOperationsBundleUploadUrl","description":"Get a presigned S3 URL to upload a custom operations plugin bundle ZIP. Upload the ZIP with a PUT to the returned url (sending the given Content-Type), then call POST /plugins to register it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"createBundleUploadUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlRequest"}}}},"responses":{"200":{"description":"A presigned upload URL for the bundle ZIP.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlResponse"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Bundle storage is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/{name}/enabled":{"patch":{"operationId":"setOperationsPluginEnabled","description":"Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setPluginEnabled","parameters":[{"schema":{"type":"string","description":"Plugin name."},"required":true,"description":"Plugin name.","name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledRequest"}}}},"responses":{"200":{"description":"The plugin's enabled state was updated, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledResponse"}}}},"404":{"description":"No such plugin for this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The plugin metadata is invalid for the requested enabled state, or the permission delta differs from `expectedPermissionDiff`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/policy":{"get":{"operationId":"getOperationsPolicy","description":"Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"getPolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The approval policy rules and default.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateOperationsPolicy","description":"Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"updatePolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateOperationsPolicyRequest"}}}},"responses":{"200":{"description":"The updated approval policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/invoke":{"post":{"operationId":"invokeOperation","description":"Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"invoke","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationRequest"}}}},"responses":{"200":{"description":"The operation was dispatched or queued for approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationResponse"}}}},"400":{"description":"Parameters do not satisfy the operation's published input schema.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not create commands for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Plugin or operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Plugin is disabled or has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/verify-check":{"post":{"operationId":"verifyOperationCheck","description":"One verification poll cycle for an original operation command. Loads that command's authoritative stored result and dispatch-time verification contract, dispatches the frozen read-only poll operation once, and evaluates its frozen success condition. Callers poll this repeatedly per the returned policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"verifyCheck","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckRequest"}}}},"responses":{"200":{"description":"The outcome of this single verification poll cycle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckResponse"}}}},"400":{"description":"The verification command cannot be dispatched to the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not dispatch verification commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or original command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid verification command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests":{"post":{"operationId":"createAccessRequest","description":"Create an access request — either plan-backed (an ai-agent investigation's exact commands) or plan-less (a CLI-originated exact operation or wildcard pattern, resolved and frozen here). Plan-backed requests await the engineer gate (status `pending-approval`); plan-less requests are queued immediately since the requester is asking for their own access (status `queued`).","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAccessRequest"}}}},"responses":{"201":{"description":"The created access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"400":{"description":"Invalid create payload or requested expiry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The requester cannot access the target deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or remediation plan not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Replay key payload conflicts or the remediation plan already has a request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listAccessRequests","description":"List a project's access requests, newest first.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AccessRequestStatus"},"description":"Filter by status."},"required":false,"description":"Filter by status.","name":"status","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Only requests proposed by this investigation's remediation plan."},"required":false,"description":"Only requests proposed by this investigation's remediation plan.","name":"agentSessionId","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"The project's access requests.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/queue":{"post":{"operationId":"queueAccessRequest","description":"Engineer gate — approve a pending access request, queuing it for the operator to materialize. Records who queued it.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The queued access request, with the customer approve command.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"kubectlApprove":{"type":"string","nullable":true}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","kubectlApprove"]}}}},"400":{"description":"The requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not pending approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/approve":{"post":{"operationId":"approveAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may approve a queued access request. Actor identity comes from authentication; method/source are audit context only.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}},"approvedForMinutes":{"type":"integer","minimum":0,"exclusiveMinimum":true}},"required":["method"]}}}},"responses":{"200":{"description":"The approved access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"approvalMethod":{"$ref":"#/components/schemas/AccessRequestApprovalMethod"}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","approvalMethod"]}}}},"400":{"description":"The approval window or requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued, or its requester identity is unknown and a new request is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/deny":{"post":{"operationId":"denyAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may reject a queued access request. Actor identity comes from authentication.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}}},"required":["method"]}}}},"responses":{"200":{"description":"The rejected access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued (already approved, denied, expired, or still pending the engineer gate).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/coordinates":{"get":{"operationId":"getAccessRequestCoordinates","description":"The customer's kubectl approve command for a queued access request, or null until the operator has materialized the grant CR and reported its coordinates. Polled by the Slack handler to update the access-plan card.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The approve command (or null) and current status.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"kubectlApprove":{"type":"string","nullable":true}},"required":["status","kubectlApprove"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/pending":{"get":{"operationId":"listPendingAccessRequests","description":"Operator-facing: queued access requests whose requester deadline has not elapsed, for the access-request sync loop to materialize as grant CRs.","x-speakeasy-ignore":true,"parameters":[{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Queued access requests for the deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"requests":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"requestedExpiresAt":{"type":"string","nullable":true}},"required":["id","title","reason","commands","debugGrant","requestedExpiresAt"]}},"revokedRequestIds":{"type":"array","items":{"type":"string"},"description":"Requests revoked in the last six hours, or revoked while their approved window is still open, so the operator can mark their grant CRs REVOKED. Older operators ignore this field."}},"required":["requests","revokedRequestIds"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/materialized":{"post":{"operationId":"reportMaterializedAccessRequests","description":"Operator-facing: record the namespace + CRD plural the operator materialized the grant CRs in, so the control plane can render the customer's exact kubectl approve command.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"requestIds":{"type":"array","items":{"type":"string"}},"namespace":{"type":"string","minLength":1},"resourcePlural":{"type":"string","minLength":1}},"required":["deploymentId","requestIds","namespace","resourcePlural"]}}}},"responses":{"200":{"description":"Number of requests updated with CR coordinates.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/approvals":{"post":{"operationId":"reportAccessApprovals","description":"Operator-facing: record the customer's approval windows reported back by the sync loop. Retires requester-expired requests and skips stale windows without blocking live approvals. Moves live requests to customer-approved and resumes the investigation to dispatch commands.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"approvals":{"type":"array","items":{"type":"object","properties":{"requestId":{"type":"string"},"approvedUntil":{"type":"string"}},"required":["requestId","approvedUntil"]}}},"required":["deploymentId","approvals"]}}}},"responses":{"200":{"description":"Number of approvals recorded.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"400":{"description":"Invalid approval report payload.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/live-debug-grant":{"get":{"operationId":"getLiveDebugGrant","description":"Find an approved, unexpired access request the caller created whose debug grant matches this deployment and tool (and, when given, namespace/cloudScope). Returns the most recently approved match, or 404 when none is live. Used to reuse an existing grant instead of proposing a new access request. Only the requester's own grants match: a debug session must present a grant its caller requested, so another principal's grant is never returned here.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"The deployment to check for a live debug grant.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"The deployment to check for a live debug grant.","name":"deploymentId","in":"query"},{"schema":{"$ref":"#/components/schemas/DebugGrantTool"},"required":true,"name":"debugTool","in":"query"},{"schema":{"type":"string","description":"Match a `kubectl` grant scoped to this namespace exactly."},"required":false,"description":"Match a `kubectl` grant scoped to this namespace exactly.","name":"debugNamespace","in":"query"},{"schema":{"type":"string","description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly."},"required":false,"description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly.","name":"debugCloudScope","in":"query"}],"responses":{"200":{"description":"A live access request with a matching debug grant.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"No approved, unexpired access request matches.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/activity":{"get":{"operationId":"getAccessRequestActivity","description":"The operation commands and debug sessions an access request authorized, with each command's verification outcome. Authorized like getAccessRequest.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The request's operations and debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRequestActivity"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/revoke":{"post":{"operationId":"revokeAccessRequest","description":"Revoke a pending, queued or customer-approved access request. The principal that created the request, or any workspace member or administrator who can read its project, may revoke it. Commands the grant authorized that have not been dispatched are failed; dispatched commands finish. Linked debug sessions are stopped and refuse their next request. Revoking an already revoked request returns it unchanged.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeAccessRequest"}}}},"responses":{"200":{"description":"The revoked access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"The caller may read but not revoke this request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The request has already expired or been rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}":{"get":{"operationId":"getAccessRequest","description":"Get an access request by id.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/list":{"post":{"operationId":"syncList","description":"List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.","x-speakeasy-group":"sync","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListRequest"}}}},"responses":{"200":{"description":"Full deployment records returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/context":{"post":{"operationId":"syncContext","description":"Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.","x-speakeasy-group":"sync","x-speakeasy-name-override":"context","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncContextRequest"}}}},"responses":{"200":{"description":"Computed deployment context returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"}}}},"404":{"description":"Deployment not found or not assigned to this manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to build deployment context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/acquire":{"post":{"operationId":"syncAcquire","description":"Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.","x-speakeasy-group":"sync","x-speakeasy-name-override":"acquire","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireRequest"}}}},"responses":{"200":{"description":"Deployments acquired successfully (empty arrays if none available). Failures indicate deployments that were locked but failed during context building - their locks have been released.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/reconcile":{"post":{"operationId":"syncReconcile","description":"Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.","x-speakeasy-group":"sync","x-speakeasy-name-override":"reconcile","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileRequest"}}}},"responses":{"200":{"description":"State reconciled successfully. If target is present, continue deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment locked (pull) or session mismatch (push).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/renew":{"post":{"operationId":"syncRenew","x-speakeasy-group":"sync","x-speakeasy-name-override":"renew","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncRenewRequest"}}}},"responses":{"200":{"description":"Renewal processed. Inspect `leases` for per-deployment outcomes; a lost lease is reported there rather than failing the whole batch.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when every requested deployment was renewed."},"leases":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"renewed":{"type":"boolean","description":"False when this session no longer holds a live lease."},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["deploymentId","renewed","leaseExpiresAt"]},"description":"Per-deployment renewal outcome."}},"required":["success","leases"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The session no longer owns the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/release":{"post":{"operationId":"syncRelease","description":"Release a deployment lock. Must be called after processing an acquired deployment, even if processing failed. This is critical to avoid deadlocks.","x-speakeasy-group":"sync","x-speakeasy-name-override":"release","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReleaseRequest"}}}},"responses":{"200":{"description":"Lock released successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when released or the exact terminal receipt was acknowledged. False when completion could not be established."}},"required":["success"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources":{"get":{"operationId":"listInventory","x-speakeasy-group":"resources","x-speakeasy-name-override":"listInventory","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Unified managed and observed resource inventory rows.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"},"source":{"type":"string","enum":["managed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt","source","deploymentId","deploymentName"]},{"type":"object","properties":{"source":{"type":"string","enum":["observed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"rawKind":{"type":"string"},"alienResourceId":{"type":"string","nullable":true},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["source","deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","name","rawKind","alienResourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}":{"get":{"operationId":"listResourceOverview","x-speakeasy-group":"resources","x-speakeasy-name-override":"listOverview","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Compute resource overview rows from latest heartbeats.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/{resourceId}/deployments":{"get":{"operationId":"listResourceDeployments","description":"List deployments where the selected resource is installed.","x-speakeasy-group":"resources","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Deployments where the resource is installed.","content":{"application/json":{"schema":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"deployments":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt"]}}},"required":["resourceType","resourceId","deployments"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/deployments/{deploymentId}/{resourceId}":{"get":{"operationId":"getResourceDeploymentDetail","x-speakeasy-group":"resources","x-speakeasy-name-override":"getDeploymentDetail","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Latest heartbeat detail for one resource deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"deployment":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"},"desiredImage":{"type":"string","nullable":true}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt","desiredImage"]},"heartbeat":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"staleAt":{"type":"string","format":"date-time"},"platformStale":{"type":"boolean"},"heartbeat":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"raw":{"type":"array","items":{"nullable":true}}},"required":["status","deploymentId","resourceId","resourceType","backend","controllerPlatform","observedAt","staleAt","platformStale","heartbeat","raw"]},{"type":"object","properties":{"status":{"type":"string","enum":["missing"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"}},"required":["status","deploymentId","resourceId","resourceType"]}]}},"required":["deployment","heartbeat"]}}}},"404":{"description":"Deployment or resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys":{"get":{"operationId":"listAwsVirtualKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"AWS Virtual Keys in a project","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKeys":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}},"required":["virtualKeys"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAwsVirtualKey","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"selector":{"oneOf":[{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false}]},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128},"alias":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"description":{"type":"string","nullable":true,"maxLength":8192},"deletionWindowDays":{"type":"integer","minimum":7,"maximum":30,"default":30},"tags":{"type":"object","additionalProperties":{"type":"string","maxLength":256},"default":{}}},"required":["selector","awsAccountId","awsRegion","idempotencyKey"]}}}},"responses":{"200":{"description":"Created or resumed Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Enterprise Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Gateway unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/rotate-credential":{"post":{"operationId":"rotateAwsVirtualKeyCredential","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"generation":{"type":"integer","minimum":2}},"required":["generation"]}}}},"responses":{"200":{"description":"The resumable XKS proxy credential rotation bundle","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot begin rotation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/restore":{"post":{"operationId":"restoreAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key awaiting a successful AWS XKS canary after restore","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot be restored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/finalize-deletion":{"post":{"operationId":"finalizeAwsVirtualKeyDeletion","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key whose final AWS KMS deletion was observed","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key deletion cannot be finalized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/decommission":{"post":{"operationId":"decommissionAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"},"deletionScheduledAt":{"type":"string","format":"date-time"}},"required":["kmsKeyArn","deletionScheduledAt"]}}}},"responses":{"200":{"description":"Virtual Key with AWS deletion scheduled","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"AWS key does not match","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}":{"get":{"operationId":"getAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"responses":{"200":{"description":"AWS Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/continue":{"post":{"operationId":"continueAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"customKeyStoreId":{"type":"string","pattern":"^cks-[A-Za-z0-9]+$"},"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["customKeyStoreId","kmsKeyArn"]}}}},"responses":{"200":{"description":"Updated AWS setup facts","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Setup facts conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resolve":{"get":{"operationId":"resolve","tags":["resolve"],"summary":"Resolve manager for a project and platform","description":"Returns the manager URL for a given project and platform. The project can be provided as a query parameter, or derived from the token's scope (project-scoped, deployment-group-scoped, or deployment-scoped tokens carry an implicit project). This is the single entry point for all CLI tools to discover which manager to talk to.","x-speakeasy-group":"resolve","x-speakeasy-name-override":"resolve","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform to resolve the manager for"},"required":true,"description":"Target platform to resolve the manager for","name":"platform","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope)."},"required":false,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope).","name":"project","in":"query"}],"responses":{"200":{"description":"Manager resolved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveResponse"}}}},"400":{"description":"Missing required project parameter for this token type.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found or no manager available for platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Manager not ready yet (no URL reported). Retry after a delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/cloud-regions":{"get":{"operationId":"getCloudRegions","description":"Get cloud regions supported by this Alien environment.","x-speakeasy-group":"cloudRegions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Supported cloud regions retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudRegionsResponse"}}}}}}},"/v1/billing/audit-log":{"get":{"operationId":"listBillingAuditLog","description":"List billing activity entries for the current workspace.","x-speakeasy-group":"billing","x-speakeasy-name-override":"listAuditLog","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"number","minimum":1,"maximum":200,"default":50},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor: id from the previous page."},"required":false,"description":"Cursor: id from the previous page.","name":"before","in":"query"}],"responses":{"200":{"description":"Audit-log rows newest-first.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/BillingAuditLogRow"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"]}}}}}}},"/v1/billing/entitlements":{"get":{"operationId":"getWorkspaceBillingEntitlements","description":"Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.","x-speakeasy-group":"billing","x-speakeasy-name-override":"getEntitlements","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace billing entitlements.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceBillingEntitlements"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/gateways/{gateway}/overview":{"get":{"operationId":"getWorkspaceGatewayOverview","description":"Get compact cross-Project setup and customer status for a workspace Gateway.","x-speakeasy-group":"gateways","x-speakeasy-name-override":"getWorkspaceOverview","parameters":[{"schema":{"$ref":"#/components/schemas/GatewayKind"},"required":true,"description":"Alien Gateway a customer deployment runs","name":"gateway","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace Gateway overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceGatewayOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}}}}
diff --git a/client-sdks/platform/rust/openapi.json b/client-sdks/platform/rust/openapi.json
index f1af52ac69..7b077c7a53 100644
--- a/client-sdks/platform/rust/openapi.json
+++ b/client-sdks/platform/rust/openapi.json
@@ -1 +1 @@
-{"openapi":"3.0.0","info":{"title":"Alien API","version":"1.0.0","contact":{"name":"Alien Team","url":"https://alien.dev"}},"servers":[{"url":"https://api.alien.dev","description":"Alien API - Production"}],"security":[{"apiKey":[]}],"components":{"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","bearerFormat":"API key","description":"API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys"}},"schemas":{"WorkspaceInvitationPreview":{"type":"object","properties":{"kind":{"type":"string","enum":["email","link"]},"workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name","logoUrl"]},"inviter":{"type":"object","nullable":true,"properties":{"name":{"type":"string"},"image":{"type":"string","nullable":true,"format":"uri"}},"required":["name","image"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"state":{"type":"string","enum":["active","accepted","expired","revoked"]},"emailHint":{"type":"string","nullable":true}},"required":["kind","workspace","inviter","role","expiresAt","state","emailHint"],"additionalProperties":false},"WorkspaceRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"Role for workspace-scoped service accounts","example":"workspace.member"},"APIError":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"requestId":{"type":"string","description":"Request ID echoed in the x-request-id response header and server logs."}},"required":["code","message","internal"]},"Membership":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"role":{"type":"string"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","logoUrl","role","createdAt"],"additionalProperties":false},"UserProfile":{"type":"object","properties":{"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","description":"User's email address"},"name":{"type":"string","description":"User's display name"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"},"githubUsername":{"type":"string","nullable":true,"description":"Linked GitHub username"},"cliConnected":{"type":"boolean","description":"Whether this user has ever authenticated a request from the Alien CLI. Latched on first CLI request, never cleared."},"company":{"type":"string","nullable":true,"description":"Company name collected during profile setup."},"acquisitionSource":{"type":"string","nullable":true,"enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other",null],"description":"How the user heard about Alien."},"acquisitionSourceDetail":{"type":"string","nullable":true,"description":"Additional acquisition source detail when the source is other."},"useCases":{"type":"string","nullable":true,"description":"What the user is hoping to use Alien for."},"profileSetupCompletedAt":{"type":"string","format":"date-time","nullable":true,"description":"When the user completed the required profile setup dialog."},"profileSetupVersion":{"type":"integer","nullable":true,"description":"Version of the required profile setup dialog the user completed."}},"required":["id","email","name","image","githubUsername","cliConnected","company","acquisitionSource","acquisitionSourceDetail","useCases","profileSetupCompletedAt","profileSetupVersion"],"additionalProperties":false},"UserProfileSetupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"},"company":{"type":"string","minLength":1,"maxLength":120,"description":"Company name"},"acquisitionSource":{"type":"string","enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other"],"description":"How the user heard about Alien"},"acquisitionSourceDetail":{"type":"string","minLength":1,"maxLength":200,"description":"Required when acquisitionSource is other"},"useCases":{"type":"string","maxLength":2000,"description":"What the user is hoping to use Alien for"}},"required":["name","company","acquisitionSource"],"additionalProperties":false},"GitNamespace":{"type":"object","properties":{"id":{"type":"number","nullable":true},"name":{"type":"string"},"slug":{"type":"string"},"installationId":{"type":"number","nullable":true},"type":{"type":"string","enum":["team","user"]},"provider":{"type":"string","enum":["github"]},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","slug","installationId","type","provider","createdAt"],"additionalProperties":false},"GitRepository":{"type":"object","properties":{"name":{"type":"string"},"private":{"type":"boolean"},"defaultBranch":{"type":"string"},"pushedAt":{"type":"string","format":"date-time"}},"required":["name","private","defaultBranch"],"additionalProperties":false},"AcceptWorkspaceInvitationResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["joined","already-member"]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"workspaceName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["outcome","workspaceId","workspaceName","role"],"additionalProperties":false},"Subject":{"oneOf":[{"$ref":"#/components/schemas/UserSubject"},{"$ref":"#/components/schemas/ServiceAccountSubject"}],"discriminator":{"propertyName":"kind","mapping":{"user":"#/components/schemas/UserSubject","serviceAccount":"#/components/schemas/ServiceAccountSubject"}},"description":"Authenticated principal that can be either a user (with workspace-scoped permissions) or a service account (with configurable scope and role)"},"UserSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["user"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","format":"email","description":"User's email address"},"workspaceId":{"type":"string","description":"ID of the workspace the user is authenticated within"},"workspaceName":{"type":"string","description":"Name of the workspace the user is authenticated within"},"role":{"$ref":"#/components/schemas/UserRole"}},"required":["kind","id","email","workspaceId","role"],"description":"Authenticated user subject with workspace-scoped permissions"},"UserRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"User's role within the workspace","example":"workspace.member"},"ServiceAccountSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["serviceAccount"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique service account identifier (API key ID)"},"workspaceId":{"type":"string","description":"ID of the workspace the service account belongs to"},"workspaceName":{"type":"string","description":"Name of the workspace the service account belongs to"},"scope":{"$ref":"#/components/schemas/SubjectScope"},"role":{"$ref":"#/components/schemas/Role"}},"required":["kind","id","workspaceId","scope","role"],"description":"Authenticated service account subject with scoped permissions (workspace, project, or deployment level)"},"SubjectScope":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["workspace"],"description":"Workspace-scoped access"}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["project"],"description":"Project-scoped access"},"projectId":{"type":"string","description":"ID of the specific project this scope applies to"}},"required":["type","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment"],"description":"Deployment-scoped access"},"deploymentId":{"type":"string","description":"ID of the specific deployment this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"}},"required":["type","deploymentId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"],"description":"Deployment group-scoped access"},"deploymentGroupId":{"type":"string","description":"ID of the specific deployment group this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"}},"required":["type","deploymentGroupId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["manager"],"description":"Manager-scoped access"},"managerId":{"type":"string","description":"ID of the specific manager this scope applies to"}},"required":["type","managerId"]}],"description":"Authorization scope defining what resources this service account can access"},"Role":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"$ref":"#/components/schemas/ProjectRole"},{"$ref":"#/components/schemas/DeploymentRole"},{"$ref":"#/components/schemas/DeploymentGroupRole"},{"$ref":"#/components/schemas/ManagerRole"}],"description":"Role defining what actions this service account can perform within its scope","example":"workspace.member"},"ProjectRole":{"type":"string","enum":["project.viewer","project.developer","project.encryption","project.ai-gateway","project.sandbox-gateway","project.remote-bindings"],"description":"Role for project-scoped service accounts","example":"project.developer"},"DeploymentRole":{"type":"string","enum":["deployment.viewer","deployment.manager","deployment.dynamic-container-manager","deployment.telemetry-writer"],"description":"Role for deployment-scoped service accounts","example":"deployment.manager"},"DeploymentGroupRole":{"type":"string","enum":["deployment-group.deployer"],"description":"Role for deployment group-scoped service accounts","example":"deployment-group.deployer"},"ManagerRole":{"type":"string","enum":["manager.runtime"],"description":"Role for manager-scoped service accounts","example":"manager.runtime"},"ProjectIDOrNamePathParam":{"type":"string","maxLength":100,"description":"Project ID or name."},"Workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name.","example":"my-workspace"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","createdAt"],"additionalProperties":false},"WorkspaceMember":{"type":"object","properties":{"userId":{"type":"string"},"email":{"type":"string"},"name":{"type":"string"},"image":{"type":"string","nullable":true},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"joinedAt":{"type":"string","format":"date-time"}},"required":["userId","email","name","image","role","joinedAt"],"additionalProperties":false},"AgentSettings":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"enabled":{"type":"boolean","description":"Workspace on/off switch for the ai-agent. When `false`, incoming triggers (release/deployment monitoring and Slack-invoked sessions) are rejected before any session runs. Defaults to `true`."},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","enabled","createdAt","updatedAt"],"additionalProperties":false},"UpdateWorkspaceSettingsRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Turn the ai-agent on (`true`) or off (`false`) for this workspace."}}},"WorkspaceInvitation":{"type":"object","properties":{"id":{"type":"string","pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"},"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"status":{"type":"string","enum":["pending","accepted","revoked","expired"]},"deliveryStatus":{"type":"string","enum":["pending","sent","failed"]},"expiresAt":{"type":"string","format":"date-time"},"lastSentAt":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","email","role","status","deliveryStatus","expiresAt","lastSentAt","createdAt","inviteUrl"],"additionalProperties":false},"WorkspaceInviteLink":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"wil_[0-9a-zA-Z]{40}$","description":"Unique identifier for the workspace invite link.","example":"wil_RgcthDSZ37rmFLekuItpFS7btjXoYwou1gE4"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"useCount":{"type":"integer","minimum":0},"lastUsedAt":{"type":"string","format":"date-time","nullable":true},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","role","expiresAt","createdAt","useCount","lastUsedAt","inviteUrl"],"additionalProperties":false},"ProjectListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"deploymentCount":{"type":"number"},"latestRelease":{"$ref":"#/components/schemas/ProjectReleaseInfo"}}}]},"DeploymentPortalAppearancePreset":{"type":"string","enum":["clean","technical","enterprise","playful","minimal"],"default":"clean","description":"Curated visual style for the deployment portal."},"DeploymentPortalAccentColor":{"type":"string","enum":["blue","purple","green","orange","pink","slate"],"default":"blue","description":"Accent color used for highlights and primary actions."},"DeploymentPortalDensity":{"type":"string","enum":["comfortable","compact"],"default":"comfortable","description":"Layout density for portal content."},"ProjectReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","gitMetadata","createdAt"]},"GitMetadata":{"type":"object","nullable":true,"properties":{"commitSha":{"type":"string","nullable":true,"pattern":"^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$","description":"The hash of the commit","example":"dc36199b2234c6586ebe05ec94078a895c707e29"},"commitMessage":{"type":"string","nullable":true,"maxLength":1024,"description":"The commit message","example":"add method to measure Interaction to Next Paint (INP) (#36490)"},"commitRef":{"type":"string","nullable":true,"maxLength":256,"description":"The branch or tag on which the commit was made","example":"main"},"commitDate":{"type":"string","nullable":true,"format":"date-time","description":"The date and time when the commit was created","example":"2026-03-16T12:00:00Z"},"dirty":{"type":"boolean","nullable":true,"description":"Whether or not there have been modifications to the working tree since the latest commit","example":true},"remoteUrl":{"type":"string","nullable":true,"maxLength":2048,"description":"The git repository's remote origin url","example":"https://github.com/alienplatform/alien"},"commitAuthorName":{"type":"string","nullable":true,"maxLength":256,"description":"The name of the author of the commit (from git config)","example":"John Doe"},"commitAuthorEmail":{"type":"string","nullable":true,"maxLength":256,"description":"The author identity recorded by Git. This is not guaranteed to be an RFC-valid email address.","example":"john@example.com"},"commitAuthorLogin":{"type":"string","nullable":true,"maxLength":256,"description":"The provider username of the commit author (e.g., GitHub login), resolved server-side from the commit email","example":"johndoe"},"commitAuthorAvatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"The avatar URL of the commit author, resolved server-side from the provider login","example":"https://github.com/johndoe.png"},"provider":{"$ref":"#/components/schemas/GitProvider"}}},"GitProvider":{"oneOf":[{"$ref":"#/components/schemas/GitHubProvider"},{"$ref":"#/components/schemas/GitLabProvider"},{"nullable":true}],"description":"Provider-specific repository information, resolved server-side from remoteUrl"},"GitHubProvider":{"type":"object","properties":{"type":{"type":"string","enum":["github"]},"org":{"type":"string","maxLength":256,"description":"Repository owner (user or organization)"},"repo":{"type":"string","maxLength":256,"description":"Repository name"}},"required":["type","org","repo"]},"GitLabProvider":{"type":"object","properties":{"type":{"type":"string","enum":["gitlab"]},"namespace":{"type":"string","maxLength":256,"description":"Group/project namespace"},"project":{"type":"string","maxLength":256,"description":"Project name"}},"required":["type","namespace","project"]},"Project":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"projectCapabilities":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"default":null,"required":["schemaVersion","capabilities"],"additionalProperties":false,"description":"Capabilities this Project may offer through setup links."},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","createdAt","workspaceId"]},"ProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","redirectUris"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"hasClientSecret":{"type":"boolean","enum":[true]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","clientId","hasClientSecret","redirectUris"]}]},"GcpOAuthClientId":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[a-zA-Z0-9_-]+-[a-zA-Z0-9_-]+\\.apps\\.googleusercontent\\.com$","description":"Google OAuth web client ID.","example":"1234567890-abc123.apps.googleusercontent.com"},"UpdateProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId"]}]},"GcpOAuthClientSecret":{"type":"string","minLength":1,"maxLength":512,"description":"Google OAuth web client secret. Write-only; never returned by the API.","example":"GOCSPX-example"},"UpdateProject":{"type":"object","properties":{"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"packagesConfigPatch":{"type":"object","properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"additionalProperties":false},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"additionalProperties":false},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"additionalProperties":false},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","nullable":true,"properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"additionalProperties":false}},"additionalProperties":false}},"additionalProperties":false}}},"DeploymentPortalDomainResponse":{"type":"object","properties":{"deploymentPortalEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"},"packageEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["deploymentPortalEndpoint","packageEndpoint"]},"DomainEndpoint":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dend_[0-9a-z]{28}$","description":"Unique identifier for the domain endpoint.","example":"dend_1bb6gdvm1bs74acqkjstcgv"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domainId":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"kind":{"$ref":"#/components/schemas/DomainEndpointKind"},"owner":{"$ref":"#/components/schemas/DomainEndpointOwner"},"hostname":{"type":"string","minLength":1,"maxLength":253},"status":{"$ref":"#/components/schemas/DomainEndpointStatus"},"provider":{"type":"string","nullable":true},"providerState":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"managedDnsRecords":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentPortalManagedDnsRecord"}},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"retryAttempts":{"type":"integer","minimum":0},"nextStepAfter":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","workspaceId","domainId","kind","owner","hostname","status","managedDnsRecords","retryAttempts","createdAt","updatedAt"]},"DomainEndpointKind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"DomainEndpointOwner":{"type":"object","properties":{"type":{"$ref":"#/components/schemas/DomainEndpointOwnerType"},"id":{"type":"string"}},"required":["type","id"]},"DomainEndpointOwnerType":{"type":"string","enum":["workspace","project","manager"]},"DomainEndpointStatus":{"type":"string","enum":["waiting_for_domain","provisioning","waiting_for_dns","waiting_for_health","active","failed","deleting"]},"DeploymentPortalManagedDnsRecord":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"value":{"type":"string"},"ttl":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true}},"required":["name","type","value"]},"DeploymentLinkSetupResponse":{"type":"object","properties":{"activeRelease":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","nullable":true},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true}},"required":["id","version","stack"]},"supportedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"setupItems":{"type":"array","items":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]}},"visiblePackageTypes":{"type":"array","items":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"}},"visibleSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"setupPackagesStatus":{"type":"string","enum":["preparing","ready","failed"],"description":"Whether at least one complete automated setup package is ready across all selected setup items."}},"required":["activeRelease","supportedPlatforms","setupItems","visiblePackageTypes","visibleSetupMethods","setupPackagesStatus"]},"StackByPlatform":{"type":"object","properties":{"aws":{"nullable":true},"gcp":{"nullable":true},"azure":{"nullable":true},"kubernetes":{"nullable":true},"machines":{"nullable":true},"local":{"nullable":true},"test":{"nullable":true}},"additionalProperties":false},"DeploymentSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform","helm","cli","manual"]},"ConfigureModelsRequest":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"minItems":1,"maxItems":100}},"required":["requirements"],"additionalProperties":false},"ProjectCapabilities":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"required":["schemaVersion","capabilities"],"additionalProperties":false},"AIProviderHeaders":{"type":"object","properties":{"providers":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"headers":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"},"value":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7E]*$"}},"required":["name","value"],"additionalProperties":false},"minItems":1,"maxItems":20}},"required":["provider","headers"],"additionalProperties":false},"maxItems":6}},"required":["providers"],"additionalProperties":false},"CapabilityMaterialization":{"type":"object","properties":{"projectCapabilities":{"$ref":"#/components/schemas/ProjectCapabilities"},"source":{"type":"object","properties":{"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"definitionVersion":{"type":"string"},"releaseId":{"type":"string"}},"required":["definitionId","definitionVersion","releaseId"]},"packages":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation","terraform","sandbox-bundle","gcp-sandbox-image"]},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"]}},"required":["type","status"]}}},"required":["projectCapabilities","source","packages"]},"ConfigureRemoteSandboxRequest":{"type":"object","properties":{"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800},"azureIdleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"additionalProperties":false},"SandboxBaseImageRepository":{"type":"object","properties":{"registryHost":{"type":"string","description":"Manager registry host to `docker login` to and push through."},"repository":{"type":"string","description":"This project's repository under that host."}},"required":["registryHost","repository"]},"ProjectCapabilityOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"configurationStatus":{"type":"string","enum":["valid","invalid"]},"hasAppRemoteSandbox":{"type":"boolean"},"summary":{"type":"object","properties":{"groups":{"type":"integer","minimum":0},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"keys":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"registry":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["groups","capabilities"]},"groups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"keys":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"buckets":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"registry":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"remoteSandbox":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["deploymentGroupId","name","externalId","createdAt","capabilities"]}}},"required":["generatedAt","configurationStatus","hasAppRemoteSandbox","summary","groups"]},"RemoteBindingsExternalAccessResponse":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1},"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","format":"uri"}},"required":["deploymentId","resourceId","accessToken","expiresIn","tokenType","managerUrl"]},"RemoteBindingsExternalAccessRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"capability":{"type":"string","enum":["storage","sandbox"]}},"required":["externalId","capability"],"additionalProperties":false},"RemoteOperatorInstallReceipt":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"renderedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","renderedAt"],"additionalProperties":false},"ObservedRemoteOperatorImageIdentity":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"observedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","observedAt"],"additionalProperties":false},"OperationsCatalogKubernetesPermissions":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsRule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false,"description":"Kubernetes RBAC required to execute this operation. Omitted by older servers and null when the operation declares none."},"OperationsCatalogKubernetesPermissionsRule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsVerb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"OperationsCatalogKubernetesPermissionsVerb":{"type":"string","enum":["get","list","watch","delete","patch"]},"RemoteOperatorPermissionPlugin":{"type":"object","properties":{"name":{"type":"string"},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"permissions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["aws","gcp"]},"kubernetesPermissions":{"type":"object","nullable":true,"properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"}},"required":["apiGroup","resource","verbs","reason"]}}},"required":["rules"]}},"required":["name","permissions"]}}},"required":["name","operations"]},"DeploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments allowed in this deployment group"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","externalId","projectId","workspaceId","createdAt"]},"CreateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments in this deployment group"}},"required":["name","project"]},"EnsureDeploymentGroupByNameRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["name","project"]},"EnsureDeploymentGroupByExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["externalId","name","project"]},"CreateSetupLinkResponse":{"allOf":[{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"},{"type":"object","properties":{"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroup"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"The persisted expiration date for the setup link"}},"required":["deploymentGroup","expiresAt"]}]},"CreateDeploymentGroupTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The API key token"},"deploymentLink":{"type":"string","description":"Formatted deployment link"}},"required":["token","deploymentLink"]},"CreateSetupLinkRequest":{"allOf":[{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"},{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"recoveryDeploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Recover Remote Operator bootstrap values for this exact existing group only if it has no deployments. Serialized with registration; never creates or rebinds a group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"}}}]},"DeploymentSetupConfigInput":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}}},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."}}},"DeploymentSetupMetadata":{"type":"object","additionalProperties":{"nullable":true}},"KubernetesClusterSource":{"type":"string","enum":["create","existing"]},"DeploymentSetupStackSettingsPolicy":{"type":"object","properties":{"defaults":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"allowedDeploymentModels":{"type":"array","items":{"type":"string","enum":["push","pull","airgapped"]}},"allowedNetworkModes":{"type":"array","items":{"type":"string","enum":["none","create","default","byo"]}},"allowedUpdatesModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required"]}},"allowedTelemetryModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required","off"]}},"allowedHeartbeatsModes":{"type":"array","items":{"type":"string","enum":["on","off"]}},"allowExternalBindings":{"type":"boolean"},"allowCustomRegistry":{"type":"boolean"}}},"EnvironmentVariableConfig":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"value":{"type":"string","maxLength":10000,"description":"Variable value (encrypted in database)"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","value","type","targetResources"]},"EnvironmentVariableType":{"type":"string","enum":["plain","secret"],"description":"Variable type (plain or secret)"},"DeploymentSetupItemSelection":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":{"type":"boolean"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"Deprecated request shorthand. Use deploymentSetupConfig.policy.allowedAIProviders."}},"required":["item","required"],"additionalProperties":false},"SetupLinkEntryPoint":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"provider":{"oneOf":[{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},{"type":"string","enum":["aws","gcp","azure"]}]}},"required":["item"],"additionalProperties":false,"description":"Portal destination to open first. This controls navigation, not authorization."},"StackInputValuesRequest":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{}},"StackInputValueRequest":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"type":"string"}}]},"ProjectIDOrNameQueryParam":{"type":"string","maxLength":100,"description":"Filter by project ID or name."},"SetDeploymentGroupExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"]},"UpdateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"maxDeployments":{"type":"integer","minimum":1,"description":"Maximum number of deployments in this deployment group"}}},"CreateDeploymentGroupTokenRequest":{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}}},"CreateFirstPartyDeploymentSessionResponse":{"type":"object","properties":{"token":{"type":"string","description":"The deployment-group session token"}},"required":["token"]},"ExternalAIBindingState":{"type":"object","properties":{"binding":{"$ref":"#/components/schemas/ExternalAIBinding"}},"required":["binding"]},"ExternalAIBinding":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"providerClientId":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialRevision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogProviderModelIds":{"type":"array","nullable":true,"items":{"type":"string"}},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"},"requiredModelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"available":{"type":"boolean","nullable":true},"accessStatus":{"type":"string","nullable":true,"enum":["verified","denied",null]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","available","accessStatus","accessObservedAt"]}},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","provider","providerEndpoint","providerClientId","keyFingerprint","credentialRevision","credentialStatus","credentialCheckedAt","catalogProviderModelIds","catalogObservedAt","requiredModelCoverage","updatedAt"]},"PutExternalAIBindingRequest":{"oneOf":[{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","openai"]},"apiKey":{"type":"string","minLength":1,"maxLength":512},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","apiKey","acknowledgeAlienCredentialAccess"],"additionalProperties":false},{"type":"object","properties":{"provider":{"type":"string","enum":["databricks"]},"workspaceUrl":{"type":"string","minLength":1,"maxLength":512},"clientId":{"type":"string","minLength":1,"maxLength":512},"clientSecret":{"type":"string","minLength":1,"maxLength":4096},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","workspaceUrl","clientId","clientSecret","acknowledgeAlienCredentialAccess"],"additionalProperties":false}]},"ExternalAIModelCheck":{"type":"object","properties":{"id":{"type":"string"},"publicModel":{"type":"string"},"status":{"type":"string","enum":["pending","running","verified","denied","failed","cancelled"]},"blockerCode":{"type":"string","nullable":true},"error":{"nullable":true},"requestedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","publicModel","status","blockerCode","requestedAt","completedAt"]},"ContainerRegistryState":{"type":"object","properties":{"route":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]},"endpoint":{"type":"object","nullable":true,"properties":{"url":{"type":"string","format":"uri"},"source":{"type":"string","enum":["runtime","custom-domain"]}},"required":["url","source"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]}}},"required":["route","endpoint","repositories","credentials"]},"CreateContainerRegistryCredentialResponse":{"type":"object","properties":{"credential":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]},"username":{"type":"string","enum":["alien"]},"password":{"type":"string"}},"required":["credential","username","password"]},"Package":{"type":"object","properties":{"id":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"type":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string","description":"Package version (e.g., '1.0.0', 'rel_abc123')"},"sourceReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release used as package build input. Null for release-less packages such as Operate Operator images.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"dependsOnPackageId":{"type":"string","nullable":true,"pattern":"pkg_[0-9a-z]{28}$","description":"Exact package dependency used as build input. Helm packages use this to identify the Operator image embedded in the chart.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"setupFingerprints":{"$ref":"#/components/schemas/SetupFingerprintMap"},"packageBuildInputHash":{"type":"string","description":"Hash of Platform-known package build request inputs: package type, source release, setup fingerprints, package config, and setup contract version"},"config":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"}},"required":["displayName","name"],"description":"Branding configuration for the deploy CLI binary."},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package paired with managed Kubernetes setup artifacts.\n\nThis is derived by the platform and is independent from the generic dependency, which\ncan point at a sandbox bundle for a mixed AWS and Kubernetes release."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for CloudFormation packages"},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image the agent binary is read from."},"baseImage":{"type":"string","description":"`custom_image` resolved to its linux/amd64 manifest, `registry/repository@sha256:...`."},"customImage":{"type":"string","description":"The developer's image as typed, which ties the package to the capability that asked."},"managerUrl":{"type":"string","description":"URL of the GCP manager whose registry proxy receives the push."}},"required":["agentImage","baseImage","customImage","managerUrl"],"description":"Configuration for a GCP sandbox image package.\n\nThe image is the developer's base with the sandbox agent and its contract layered on, pushed\ninto the project's path of the GCP manager's registry."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"managerUrl":{"type":"string","description":"Resolved default management endpoint captured when this build was queued."},"operationPermissions":{"type":"array","nullable":true,"items":{"type":"object","properties":{"operation":{"type":"string","description":"Operation name within the plugin."},"permissions":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Kubernetes API group. An empty string denotes the core API."},"reason":{"type":"string","description":"Human-readable reason the operation requires this rule."},"resource":{"type":"string","description":"Plural Kubernetes resource, optionally with a supported subresource."},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Optional concrete resource names. Empty means all names in the installation scope."},"verbs":{"type":"array","items":{"type":"string"},"description":"Concrete Kubernetes API verbs required by the operation."}},"required":["apiGroup","reason","resource","verbs"],"description":"One Kubernetes API requirement declared by an enabled operation."},"description":"Explicit Kubernetes API requirements."},"schemaVersion":{"type":"integer","minimum":0,"description":"Schema version of the validated permission declaration."}},"required":["rules","schemaVersion"],"description":"Versioned Kubernetes API requirements declared by an enabled operation."},"plugin":{"type":"string","description":"Operations plugin name."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier of an enabled operation in a Helm build snapshot."}},"required":["operation","permissions","plugin","tier"],"description":"Canonical Kubernetes permission snapshot for one enabled operation."},"description":"Canonical Kubernetes permissions for the operations enabled when this build was queued.\n\nThis is derived by the platform and persisted with the build request. It is not part of\nthe user-authored project package configuration. `None` identifies an older package row\nthat must be re-enqueued; an empty `Some` is a reviewed snapshot with no extra grants."},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","description":"Existing namespace claim instead of creating a new claim."},"size":{"type":"string","description":"Requested claim capacity, for example 1Gi."},"storageClassName":{"type":"string","description":"Cluster storage class; empty uses the cluster default."}},"required":["enabled","existingClaim","size","storageClassName"],"description":"Operator identity storage in the generated chart. This does not install a storage driver."},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","description":"Data key inside the Secret."},"name":{"type":"string","description":"Fixed Kubernetes Secret name expected by the workload's Secret mount."},"prefix":{"type":"string","description":"Plaintext prefix before the random alphanumeric suffix."},"randomLength":{"type":"integer","minimum":0,"description":"Length of the random suffix."}},"required":["key","name","prefix","randomLength"],"description":"Non-secret configuration for a chart-generated enrollment token."},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Empty string for the core Kubernetes API group."},"resources":{"type":"array","items":{"type":"string"},"description":"Kubernetes plural resource names; wildcards are not accepted."}},"required":["apiGroup","resources"],"description":"Resource family the chart grants get/list/watch over."},"description":"Exact API groups and resources. Verbs are fixed to get/list/watch."},"serviceAccountProfile":{"type":"string","description":"Permission profile used by the workload Container and generated ServiceAccount."}},"required":["rules","serviceAccountProfile"],"description":"Cluster reads granted to a workload identity, separate from Operator permissions."}},"required":["tokenSecret","workloadReadAccess"],"description":"Kubernetes resources created by the product chart before the runtime starts."}},"required":["chartName","description"],"description":"Configuration for the Helm chart package"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"}},"required":["displayName","name"],"description":"Branding configuration for the Operator image."},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image copied into the bundle."},"baseImage":{"type":"string","description":"The base container image the sandbox filesystem starts from. A release-pushed image\narrives resolved onto the private registry template with its {region} token intact."},"objectKey":{"type":"string","description":"Object key the bundle is written under in every regional bundle store."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store must receive this bundle. Part of the build input hash,\nso a newly supported region re-mints the bundle instead of silently missing it."}},"required":["agentImage","baseImage","objectKey"],"description":"Configuration for a sandbox bundle package.\n\nThe bundle is a zip holding one Dockerfile that layers the published Alien sandbox agent\nonto the vendor's base image; everything the builder writes is derived from these fields."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package used to compose managed Kubernetes modules.\n\nThis is derived by the platform and persisted with the build request. It is separate\nfrom the generic package dependency because a mixed AWS and Kubernetes release can also\ndepend on a sandbox bundle."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for Terraform package generation."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]}],"description":"Type-specific configuration"},"outputs":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"digest":{"type":"string","description":"Image digest (e.g., \"sha256:abc123...\")"},"image":{"type":"string","description":"Full image reference (e.g., \"public.ecr.aws/acme/operators/project-id:1.2.3\")"},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain packaged into the Operator image, if whitelabeled."}},"required":["digest","image"],"description":"Outputs from an Operator image package build"},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentDigest":{"type":"string","description":"Manifest digest of the linux/amd64 agent image the agent binary came from."},"baseDigest":{"type":"string","description":"Manifest digest of the linux/amd64 base the image was built from."},"digest":{"type":"string","description":"Manifest digest of the pushed image."},"image":{"type":"string","description":"Native registry reference pinned by digest, the value a GCP sandbox stack names."},"reuseKey":{"type":"string","description":"Hash of the base digest, the agent image reference and the image contract; equal keys reuse."}},"required":["agentDigest","baseDigest","digest","image","reuseKey"],"description":"Outputs from a GCP sandbox image package build."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"bundleUriTemplate":{"type":"string","description":"Bundle URI with the {region} token in the bucket, resolved by the deploy-time emitters."},"objectKey":{"type":"string","description":"Object key the bundle was written under in every regional bundle store."},"regions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store received this bundle."},"sha256":{"type":"string","description":"SHA256 checksum of the region-neutral bundle zip; a region-templated base image makes\neach regional object differ from it only in the rendered region."},"size":{"type":"integer","minimum":0,"description":"Region-neutral bundle zip size in bytes."}},"required":["bundleUriTemplate","objectKey","regions","sha256","size"],"description":"Outputs from a sandbox bundle package build."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]},{"nullable":true}],"description":"Package outputs (only when status is 'ready')"},"error":{"nullable":true,"description":"Error information if status is 'failed'"},"sourceBinarySha256":{"type":"string","nullable":true,"description":"Builder-recorded source binary SHA256 (for cli/terraform packages)"},"retries":{"type":"integer","minimum":0,"description":"Number of build retries"},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"leaseExpiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Expiration of the current builder lease"},"buildPhase":{"type":"string","nullable":true,"enum":["building","publishing",null],"description":"Coarse package build phase"},"lastProgressAt":{"type":"string","format":"date-time","nullable":true,"description":"Last successful builder lease renewal or phase change"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","projectId","workspaceId","type","status","version","setupFingerprints","packageBuildInputHash","config","retries","createdAt","updatedAt"]},"SetupFingerprintMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/SetupFingerprintInfo"},"description":"Per-target setup compatibility fingerprints copied from the source release"},"SetupFingerprintInfo":{"type":"object","properties":{"target":{"$ref":"#/components/schemas/SetupTarget"},"fingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"version":{"$ref":"#/components/schemas/SetupFingerprintVersion"}},"required":["target","fingerprint","version"]},"SetupTarget":{"type":"string","minLength":1,"description":"Stable target key for the setup contract, e.g. aws/us-east-1"},"SetupFingerprint":{"type":"string","minLength":1,"description":"Deterministic setup contract fingerprint for one setup target"},"SetupFingerprintVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup fingerprint algorithm version"},"ReleaseListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Release"},{"type":"object","properties":{"currentChannels":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannelName"},"description":"Channels for which this release is currently selected"},"commitUrl":{"type":"string","nullable":true,"format":"uri","description":"Validated canonical provider URL for the exact commit"},"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"rollout":{"type":"object","nullable":true,"properties":{"updatedCount":{"type":"integer","description":"Deployments that finished updating to this release (excludes initial provisions)"},"pendingCount":{"type":"integer","description":"Deployments currently targeting this release but not yet running it"},"avgDurationMs":{"type":"number","nullable":true,"description":"Average time from release creation until a deployment finished updating, in milliseconds"}},"required":["updatedCount","pendingCount","avgDurationMs"],"description":"Rollout stats, included when ?include=rollout is used"},"createdBy":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"User ID"},"name":{"type":"string","description":"User's display name"},"email":{"type":"string","description":"User's email address"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"}},"required":["id","name","email","image"],"description":"Platform user who created the release, included when ?include=createdBy is used"}},"required":["currentChannels","commitUrl"]}]},"ReleaseChannelName":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$"},"Release":{"type":"object","properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"projectId":{"type":"string","maxLength":128},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true},"setupFingerprints":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintMap"},{"description":"Per-target setup compatibility fingerprints for this release"}]},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"createdByUserId":{"type":"string","nullable":true,"maxLength":128,"description":"ID of the platform user who created the release, if known"},"workspaceId":{"type":"string","maxLength":128}},"required":["id","projectId","version","createdAt","setupFingerprints","workspaceId"]},"CreateReleaseRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"stack":{"$ref":"#/components/schemas/StackByPlatform"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"channel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Release channel to advance. Defaults to production."}]}},"required":["project"]},"ReleaseAuthorFilterItem":{"type":"object","properties":{"login":{"type":"string","nullable":true,"description":"Provider username (e.g., GitHub login)"},"name":{"type":"string","nullable":true,"description":"Git commit author name"},"avatarUrl":{"type":"string","nullable":true,"format":"uri","description":"Author avatar URL"}},"required":["login","name","avatarUrl"]},"ReleaseDeploymentsResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseDeploymentItem"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"},"stateCounts":{"$ref":"#/components/schemas/ReleaseRolloutStateCounts"}},"required":["items","nextCursor","stateCounts"]},"ReleaseDeploymentItem":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"deploymentGroup":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"],"description":"Deployment group this deployment belongs to"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"rolloutState":{"$ref":"#/components/schemas/ReleaseRolloutState"},"releasedAt":{"type":"string","format":"date-time","nullable":true,"description":"When this release went live on the deployment, null if it never did"},"durationMs":{"type":"integer","nullable":true,"description":"Time from release creation until the deployment finished updating, in milliseconds. Null for initial provisions and deployments that never ran this release."},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"}},"required":["id","name","status","platform","rolloutState","releasedAt","durationMs"]},"ReleaseRolloutState":{"type":"string","enum":["updated","updating","failed","pending","pinned-other","superseded","on-other"]},"ReleaseRolloutStateCounts":{"type":"object","properties":{"updated":{"type":"integer"},"updating":{"type":"integer"},"failed":{"type":"integer"},"pending":{"type":"integer"},"pinned-other":{"type":"integer"},"superseded":{"type":"integer"},"on-other":{"type":"integer"}},"required":["updated","updating","failed","pending","pinned-other","superseded","on-other"],"description":"Deployment counts per rollout state across all deployments the filters allow (ignores the state filter)"},"ReleaseChannel":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"deploymentCount":{"type":"integer","minimum":0},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","projectId","name","currentReleaseId","createdAt","updatedAt"]},"DeploymentListItemResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if in a failed state"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"$ref":"#/components/schemas/ManagerID"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentProtocolVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"DeploymentState protocol version owned by the runtime/manager"},"DeploymentPurpose":{"type":"string","enum":["application","encryption","ai","storage","container-registry","sandbox"],"description":"Operational purpose of this deployment within its customer environment."},"OperatorCapabilityReport":{"type":"object","properties":{"key":{"type":"string","minLength":1,"maxLength":128},"state":{"$ref":"#/components/schemas/OperatorCapabilityState"},"detail":{"type":"string","nullable":true,"maxLength":512}},"required":["key","state"]},"OperatorCapabilityState":{"type":"string","enum":["granted","denied","unavailable"]},"ManagerID":{"type":"string","pattern":"mgr_[0-9a-z]{28}$","description":"ID of the manager","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"DeploymentReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","minLength":1,"maxLength":256},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","version","createdAt"]},"DeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"]},"DeploymentProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"}},"required":["id","name"]},"DeploymentStats":{"type":"object","properties":{"total":{"type":"number","description":"Total number of deployments matching filters"},"byStatus":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by status (only includes statuses with non-zero counts)"},"byPlatform":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by platform (only includes platforms with non-zero counts)"},"byCurrentRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by currentReleaseId. The empty string key represents deployments with no current release (initial provisioning)."},"byPinnedRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by pinnedReleaseId among deployments that are pinned. Excludes unpinned deployments."},"byOrigin":{"type":"object","properties":{"framework":{"type":"number"},"remoteOperator":{"type":"number"}},"description":"Count of deployments introduced through each deployment path."}},"required":["total","byStatus","byPlatform","byCurrentRelease","byPinnedRelease","byOrigin"]},"DeploymentDetailResponse":{"allOf":[{"$ref":"#/components/schemas/Deployment"},{"type":"object","properties":{"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"},"operatorSync":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dosy_[0-9a-z]{28}$","description":"Unique identifier for the deployment operator sync.","example":"dosy_uxveigz3biyrosqycaqubbr"},"status":{"$ref":"#/components/schemas/DeploymentOperatorSyncStatus"},"stuckReason":{"$ref":"#/components/schemas/DeploymentOperatorSyncStuckReason"},"statusMessage":{"type":"string","nullable":true,"description":"Human-readable explanation of the status"},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash last reported by the Operator"},"missingOperations":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Expected `plugin/operation` names not reported by the Operator (catalog-mismatch only)"},"plugins":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/DeploymentOperatorSyncPlugin"},"description":"Enabled plugins compared with what the Operator last reported loading. Null when the sync fingerprints cannot be read."},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","targetBundleHash","targetSetAt"],"description":"Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments."}}}]},"ReportedOperation":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"name":{"type":"string","minLength":1,"maxLength":128}},"required":["plugin","pluginVersion","name"]},"DeploymentUpdateOperationSummary":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"status":{"$ref":"#/components/schemas/DeploymentUpdateOperationStatus"},"reasons":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentUpdateReason"}},"targetReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"changedKeys":{"type":"array","items":{"type":"string"}},"actionRequired":{"type":"string","nullable":true,"description":"Action needed before this update can execute; the current release remains installed."},"requestedAt":{"type":"string","format":"date-time"},"startedAt":{"type":"string","format":"date-time","nullable":true},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","reasons","targetReleaseId","changedKeys","requestedAt"]},"DeploymentUpdateOperationStatus":{"type":"string","enum":["blocked","queued","applying","succeeded","failed","superseded"]},"DeploymentUpdateReason":{"type":"string","enum":["configuration","redeploy","release"]},"DeploymentOperatorSyncStatus":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"DeploymentOperatorSyncStuckReason":{"type":"string","nullable":true,"enum":["download-failed","sync-stalled","catalog-mismatch",null]},"DeploymentOperatorSyncPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string","description":"Version the Operator should run"},"source":{"type":"string","enum":["builtin","custom"]},"state":{"type":"string","enum":["running","adding","updating","removing"],"description":"What the Operator still has to do for this plugin"},"previousVersion":{"type":"string","nullable":true,"description":"Version the Operator is running now (only while updating)"}},"required":["name","version","source","state"]},"Deployment":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentConnectionInfo":{"type":"object","properties":{"arc":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Manager URL for commands"},"deploymentId":{"type":"string","description":"Deployment ID to use in command requests"}},"required":["url","deploymentId"]},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"publicEndpoints":{"type":"object","additionalProperties":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"protocol":{"type":"string","enum":["http","tcp"]},"host":{"type":"string","minLength":1},"port":{"type":"integer","minimum":1,"maximum":65535},"wildcardHost":{"type":"string"}},"required":["url","protocol","host","port"]},"description":"Public endpoints keyed by endpoint name."}},"required":["type"]},"description":"Deployed resources and their public endpoints"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string"}},"required":["arc","resources","status","platform"]},"CreateDeploymentResponse":{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/Deployment"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Effective deployment model persisted for the deployment."},"token":{"type":"string","description":"Deployment token (only returned when using deployment group token)"}},"required":["deployment","deploymentModel"]},"NewDeploymentRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentGroupId":{"type":"string","description":"Required for workspace/project tokens. Deployment group tokens use their own group automatically."},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Optional manager to assign. If omitted, the project default or system manager is selected."}]},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"environmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"},"description":"Configuration of environment variables for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"Stack settings for deployment customization"},"resourcePrefix":{"$ref":"#/components/schemas/ResourcePrefix"},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method that created the deployment. Defaults to cli."}]},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup method metadata used to guide privileged teardown."}]},"inputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{},"description":"Stack input values provided by the deployment creator."},"operatorScope":{"type":"string","minLength":1,"maxLength":512,"description":"Display-only scope reported by the Operator manifest."},"operatorPermission":{"type":"string","minLength":1,"maxLength":64,"description":"Display-only permission tier reported by the Operator manifest."},"initialDesiredRelease":{"type":"string","enum":["active","none"],"default":"active","description":"Desired-release selection for a new deployment. Use none to register an environment without initially requesting a release; later updates can assign one."},"releaseChannel":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","default":"production","description":"Release channel followed while this deployment is not pinned."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Customer setup item selected from this deployment-group token."},"setupHandoff":{"type":"string","enum":["immediate","await-registration"],"default":"immediate","description":"Use await-registration when CloudFormation will create the infrastructure and register this deployment."}},"required":["name","platform","project"],"additionalProperties":false,"description":"Request schema for creating a new deployment"},"ResourcePrefix":{"type":"string","pattern":"^[a-z](?:[a-z0-9]|-(?=[a-z0-9])){1,38}[a-z0-9]$","description":"Optional physical-name prefix for generated cloud resources. Omit to let the manager generate one."},"ImportDeploymentRequest":{"oneOf":[{"$ref":"#/components/schemas/ForwardImportRequest"},{"$ref":"#/components/schemas/PersistImportedDeploymentRequest"}],"description":"Request schema for importing a deployment from resolved setup infrastructure"},"ForwardImportRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["forward"],"default":"forward"},"project":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user-session callers."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Required for user-session callers. Deployment-group tokens use their own group automatically.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager ID. If omitted, the first suitable manager for the source platform is used."}]},"source":{"$ref":"#/components/schemas/ImportSource"},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Exact item selected from a tailored customer setup link."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["source"]},"ImportSource":{"type":"object","properties":{"deploymentName":{"type":"string","minLength":1,"description":"User-chosen deployment name. Must be unique within the deployment group; the manager returns 409 on collision."},"resourcePrefix":{"allOf":[{"$ref":"#/components/schemas/ResourcePrefix"},{"description":"Stable physical-name prefix used by the setup artifact."}]},"sourceKind":{"$ref":"#/components/schemas/ImportSourceKind"},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup source metadata needed to guide privileged teardown."}]},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release that produced the setup artifact. Defaults to latest.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Cloud platform of the imported stack"},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"region":{"type":"string","description":"Region or location reported by the setup artifact"},"setupTarget":{"allOf":[{"$ref":"#/components/schemas/SetupTarget"},{"description":"Setup target this package was generated for"}]},"setupImportFormatVersion":{"$ref":"#/components/schemas/SetupImportFormatVersion"},"setupFingerprint":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprint"},{"description":"Setup compatibility fingerprint embedded in the package"}]},"setupFingerprintVersion":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintVersion"},{"description":"Setup fingerprint algorithm version embedded in the package"}]},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ImportedResource"},"minItems":1}},"required":["deploymentName","resourcePrefix","platform","region","setupTarget","setupImportFormatVersion","setupFingerprint","setupFingerprintVersion","stackSettings","resources"],"description":"Resolved setup import payload"},"ImportSourceKind":{"type":"string","enum":["cloudformation","terraform","helm"],"description":"Source label for observability only — does not affect import behavior."},"KubernetesBasePlatform":{"type":"string","enum":["aws","gcp","azure"],"description":"Base cloud platform for cloud-backed Kubernetes imports."},"SetupImportFormatVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup import payload format version embedded in the package"},"ImportedResource":{"type":"object","properties":{"id":{"type":"string","description":"Resource id from the active stack"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"importData":{"type":"object","additionalProperties":{"nullable":true},"description":"Resolved typed import payload"}},"required":["id","type","importData"]},"PersistImportedDeploymentRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["persist"]},"name":{"type":"string","minLength":1,"description":"Deployment name. Must be unique within the deployment group."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"stackState":{"nullable":true},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"runtimeMetadata":{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},"scheduleReconciliation":{"type":"boolean","default":false},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"default":"provisioning","description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"currentReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"importSource":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"setupMetadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"setupTarget":{"$ref":"#/components/schemas/SetupTarget"},"setupFingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"setupFingerprintVersion":{"$ref":"#/components/schemas/SetupFingerprintVersion"},"deploymentToken":{"type":"string"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["mode","name","deploymentGroupId","managerId","platform","stackSettings","runtimeMetadata","deploymentProtocolVersion","setupTarget","setupFingerprint","setupFingerprintVersion"]},"SetFirstPartyDeploymentInputsResponse":{"type":"object","properties":{"ok":{"type":"boolean"}},"required":["ok"]},"SetFirstPartyDeploymentInputsRequest":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"releaseChannel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["platform"]},"SetupRegistrationOperationResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"status":{"$ref":"#/components/schemas/SetupRegistrationOperationStatus"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"physicalResourceId":{"type":"string","nullable":true},"result":{"$ref":"#/components/schemas/SetupRegistrationOperationResult"},"error":{"type":"object","nullable":true,"properties":{"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["message","retryable"]}},"required":["id","action","sourceKind","status","deploymentId","physicalResourceId","result","error"]},"SetupRegistrationAction":{"type":"string","enum":["create","update","delete"]},"SetupRegistrationOperationStatus":{"type":"string","enum":["pending","processing","waiting-for-handoff","succeeded","failed","responding","responded"]},"SetupRegistrationOperationResult":{"type":"object","nullable":true,"properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentToken":{"type":"string","nullable":true},"helmValues":{"type":"string","nullable":true}},"required":["deploymentId","deploymentToken","helmValues"]},"CreateSetupRegistrationOperationRequest":{"type":"object","properties":{"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"source":{"allOf":[{"$ref":"#/components/schemas/ImportSource"}],"nullable":true},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":512},"cloudFormation":{"$ref":"#/components/schemas/SetupRegistrationCloudFormationTarget"}},"required":["action","sourceKind"],"additionalProperties":false},"SetupRegistrationCloudFormationTarget":{"type":"object","nullable":true,"properties":{"stackId":{"type":"string","minLength":1},"requestId":{"type":"string","minLength":1},"logicalResourceId":{"type":"string","minLength":1},"responseUrl":{"type":"string","format":"uri"},"physicalResourceId":{"type":"string","nullable":true,"minLength":1},"serviceTimeoutSeconds":{"type":"integer","minimum":60,"maximum":7200,"default":3300}},"required":["stackId","requestId","logicalResourceId","responseUrl"],"additionalProperties":false},"DeleteDeploymentResponse":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]},"message":{"type":"string"}},"required":["action","message"]},"DeleteDeploymentRequest":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]}},"required":["action"]},"PinReleaseRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release ID to pin the deployment to. Set to null to resume its followed channel.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for pinning/unpinning deployment release"},"DeploymentInputsResponse":{"type":"object","properties":{"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"values":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"description":"Current non-secret input values. Secret values are never returned."},"providedInputIds":{"type":"array","items":{"type":"string"},"description":"Input IDs that currently have a value, including redacted secrets."}},"required":["inputs","values","providedInputIds"]},"UpdateDeploymentComputeRequest":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]}}},"UpdateDeploymentInputsResponse":{"allOf":[{"$ref":"#/components/schemas/DeploymentInputsResponse"},{"type":"object","properties":{"runtimeUpdateRequested":{"type":"boolean"},"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["runtimeUpdateRequested","outcome","operation"]}]},"UpdateDeploymentInputsRequest":{"type":"object","properties":{"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"clearInputIds":{"type":"array","items":{"type":"string"},"default":[]}},"additionalProperties":false},"UpdateDeploymentEnvironmentVariablesRequest":{"type":"object","properties":{"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"value":{"type":"string","description":"Variable value"},"type":{"type":"string","enum":["plain","secret"],"description":"Variable type"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources)"}},"required":["name","value","type"]},"description":"Environment variables for the deployment"}},"required":["variables"],"additionalProperties":false,"description":"Request schema for updating deployment environment variables"},"CreateDeploymentTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The generated deployment token (only shown once)"},"deploymentId":{"type":"string","description":"The deployment ID that this token is scoped to"}},"required":["token","deploymentId"]},"CreateDeploymentTokenRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128,"description":"Optional description for the deployment token"},"expiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Optional expiration date for the deployment token"}},"required":["description"]},"DynamicContainerResponse":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"appliedGeneration":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"statusMessage":{"type":"string","nullable":true},"internalServices":{"type":"array","items":{"type":"object","properties":{"internalDns":{"type":"string"},"port":{"type":"integer"}},"required":["internalDns","port"]}},"deleted":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["name","spec","generation","appliedGeneration","status","statusMessage","internalServices","deleted","createdAt","updatedAt"]},"DynamicContainerName":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"DynamicContainerSpec":{"type":"object","properties":{"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"resources":{"type":"object","properties":{"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"}},"required":["cpu","memory"]},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192},"default":{}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]}},"required":["image","resources","replicas","ports"],"additionalProperties":false},"PutDynamicContainerRequest":{"type":"object","properties":{"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}}},"required":["spec"],"additionalProperties":false},"ListDeploymentMachinesResponse":{"type":"object","properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentMachine"}}},"required":["machines"]},"DeploymentMachine":{"type":"object","properties":{"clusterResourceId":{"type":"string"},"machineId":{"type":"string"},"status":{"type":"string"},"capacityGroup":{"type":"string"},"zone":{"type":"string"},"cpu":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"memory":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"storage":{"type":"object","nullable":true,"properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"workloadId":{"type":"string","nullable":true},"workloadName":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true},"schedulingMode":{"type":"string","nullable":true},"state":{"type":"string","nullable":true}},"required":["reason"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"overlayIp":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"horizondVersion":{"type":"string","nullable":true},"networkHealth":{"type":"string","enum":["unknown","healthy","degraded"]},"wireguardMesh":{"type":"object","nullable":true,"properties":{"expectedPeerCount":{"type":"integer","minimum":0},"reachablePeerCount":{"type":"integer","minimum":0},"missingPeerMachineIds":{"type":"array","items":{"type":"string"}}},"required":["expectedPeerCount","reachablePeerCount","missingPeerMachineIds"]},"wireguardMeshObservedAt":{"type":"string","nullable":true},"localOverrides":{"type":"array","items":{"type":"object","properties":{"activeDigest":{"type":"string","nullable":true},"actor":{"type":"string","nullable":true},"baseAssignmentHash":{"type":"string"},"baseDigest":{"type":"string","nullable":true},"candidateDigest":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"failureCategory":{"type":"string","nullable":true},"fallbackDigest":{"type":"string","nullable":true},"forcedStop":{"type":"boolean","nullable":true},"healthySince":{"type":"string","nullable":true},"incidentId":{"type":"string","nullable":true},"lifecycle":{"type":"string"},"phaseStartedAt":{"type":"string","nullable":true},"replicaId":{"type":"string"},"workloadName":{"type":"string"}},"required":["baseAssignmentHash","lifecycle","replicaId","workloadName"]}},"localOverridesObservedAt":{"type":"string","nullable":true},"replicaCount":{"type":"integer"}},"required":["clusterResourceId","machineId","status","capacityGroup","zone","cpu","memory","drainBlockers","drainForce","lastHeartbeat","localOverrides","replicaCount"]},"DeploymentCredentialRotationStatus":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0},"rotation":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}},"required":["deploymentId","revision","rotation"]},"DeploymentCredentialRotation":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"expiresAt":{"type":"string"}},"required":["id","revision","status","expiresAt"]},"DeploymentCredentialRotationValues":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"token":{"type":"string"}},"required":["deploymentId","revision","token"]},"CreateManagerResponse":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["pending"]},"setupToken":{"type":"string"},"setupTokenId":{"type":"string"},"deploymentLink":{"type":"string"},"setupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"inputValues":{"$ref":"#/components/schemas/EncryptedStackInputValues"},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8,"description":"Immutable setup items and exact sources captured when this setup link is created."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string","enum":["plain","secret"]},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"}}},"required":["name","type","targetResources"]}}},"required":["metadata","policy","environmentVariables"]},"setup":{"oneOf":[{"type":"object","properties":{"method":{"type":"string","enum":["cloudformation"]},"deploymentPortalUrl":{"type":"string"},"launchUrl":{"type":"string"},"templateUrl":{"type":"string"},"stackName":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","launchUrl","templateUrl","stackName","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["google-oauth"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"oauthStartUrl":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","oauthStartUrl","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["terraform"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"providerSource":{"type":"string"},"moduleSource":{"type":"string"},"moduleVersion":{"type":"string"},"moduleInputs":{"type":"object","additionalProperties":{"type":"string"}},"mainTf":{"type":"string"},"tfvars":{"type":"string"},"commands":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","providerSource","moduleSource","moduleInputs","mainTf","tfvars","commands","stackSettings"]}]}},"required":["managerId","setupStatus","setupToken","setupTokenId","deploymentLink","setupConfig","setup"]},"DeploymentSetupPolicy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}},"required":["allowedPlatforms","allowedSetupMethods"]},"EncryptedStackInputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/EncryptedStackInputValue"},"default":{}},"EncryptedStackInputValue":{"type":"object","properties":{"value":{"type":"string","description":"Encrypted JSON-encoded input value."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"]},"secret":{"type":"boolean","description":"Whether the original input is secret."}},"required":["value","kind","secret"]},"NewManagerRequest":{"type":"object","properties":{"name":{"type":"string"},"cloud":{"$ref":"#/components/schemas/PrivateManagerCloud"},"region":{"type":"string","minLength":1,"maxLength":64,"description":"Cloud region for the manager."},"setupMethod":{"$ref":"#/components/schemas/PrivateManagerSetupMethod"},"network":{"type":"string","enum":["create","default"],"description":"Optional network mode for the private-manager setup. Defaults to create for production isolation; default uses the provider default network for faster dev/test setup."},"otlpConfig":{"type":"object","properties":{"logsEndpoint":{"type":"string","format":"uri","description":"External OTLP logs endpoint (e.g. https://api.axiom.co/v1/logs)"},"logsAuthHeader":{"type":"string","description":"Auth header in 'key=value,...' format (e.g. 'authorization=Bearer <token>,x-axiom-dataset=<dataset>')"}},"required":["logsEndpoint","logsAuthHeader"],"description":"Optional external OTLP config for forwarding logs to Axiom, Datadog, etc. Falls back to built-in DeepStore when not set."}},"required":["name","cloud","region"]},"PrivateManagerCloud":{"type":"string","enum":["aws","gcp","azure"],"description":"Cloud where the private manager will be deployed."},"PrivateManagerSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform"],"description":"Optional setup method. Defaults to cloudformation for AWS, google-oauth for GCP, and terraform for Azure."},"ManagerRetryResponse":{"oneOf":[{"allOf":[{"$ref":"#/components/schemas/CreateManagerResponse"},{"type":"object","properties":{"mode":{"type":"string","enum":["setup"]}},"required":["mode"]}]},{"$ref":"#/components/schemas/ManagerRetryDeploymentResponse"}]},"ManagerRetryDeploymentResponse":{"type":"object","properties":{"mode":{"type":"string","enum":["deployment"]},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["provisioning"]},"deploymentId":{"type":"string"},"message":{"type":"string"}},"required":["mode","managerId","setupStatus","deploymentId","message"]},"Manager":{"type":"object","properties":{"id":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for the manager"}]},"name":{"type":"string","description":"Display name of the manager"},"targets":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms this manager can handle"},"cloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where this private manager is deployed"},"region":{"type":"string","nullable":true,"description":"Cloud region selected for this private manager"},"setupStatus":{"type":"string","nullable":true,"enum":["pending","provisioning","active","failed","deleting","deleted",null],"description":"Private manager setup lifecycle status"},"url":{"type":"string","nullable":true,"format":"uri","description":"Manager URL (self-reported via heartbeat). DeepStore endpoints are exposed through this URL (e.g., {url}/v1/logs)"},"managementConfigs":{"$ref":"#/components/schemas/ManagerManagementConfigs"},"isSystem":{"type":"boolean","description":"Whether this is a system manager (Alien-hosted)"},"workspaceId":{"type":"string","description":"The workspace ID (for system managers, this is ALIEN_WORKSPACE_ID)"},"status":{"$ref":"#/components/schemas/ManagerStatus"},"version":{"type":"string","nullable":true,"description":"Manager version (self-reported via heartbeat)"},"metrics":{"type":"object","nullable":true,"properties":{"activeDeployments":{"type":"number","description":"Number of active deployments"},"pendingDeployments":{"type":"number","description":"Number of pending deployments"},"memoryUsageMb":{"type":"number","description":"Memory usage in megabytes"},"cpuUsagePercent":{"type":"number","description":"CPU usage percentage"}},"description":"Runtime metrics (self-reported via heartbeat)"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the manager"},"logsDatabaseId":{"type":"string","nullable":true,"description":"ID of the logs database associated with this manager"},"managedDeploymentCount":{"type":"integer","minimum":0,"description":"Number of deployments currently being managed by this manager"},"defaultProjectCount":{"type":"integer","minimum":0,"description":"Number of projects that select this manager as a default manager"},"createdAt":{"type":"string","format":"date-time","description":"Timestamp when the manager was created"}},"required":["id","name","targets","managementConfigs","isSystem","workspaceId","status","managedDeploymentCount","defaultProjectCount","createdAt"],"description":"Manager schema"},"ManagerManagementConfigs":{"type":"object","properties":{"aws":{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"},"platform":{"type":"string","enum":["aws"]}},"required":["managingRoleArn","platform"]},"gcp":{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"},"platform":{"type":"string","enum":["gcp"]}},"required":["serviceAccountEmail","platform"]},"azure":{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."},"platform":{"type":"string","enum":["azure"]}},"required":["managingTenantId","oidcIssuer","oidcSubject","platform"]},"kubernetes":{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}},"description":"Per-platform management configurations for cross-account access (self-reported via heartbeat)"},"ManagerStatus":{"type":"string","enum":["healthy","degraded","unhealthy","unknown"],"description":"Current health status"},"ManagerDomainBindingResponse":{"type":"object","properties":{"managerDomainBinding":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["managerDomainBinding"]},"UpdateManagerDomainBinding":{"type":"object","properties":{"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"}},"additionalProperties":false},"UpdateManagerRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Optional release ID to update to. If not provided, the active release will be chosen","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for updating a manager to a new release"},"Event":{"type":"object","properties":{"id":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"debugSessionId":{"type":"string","nullable":true,"pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"data":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["LoadingConfiguration"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["Finished"]}},"required":["type"]},{"type":"object","properties":{"stack":{"type":"string","description":"Name of the stack being built"},"type":{"type":"string","enum":["BuildingStack"]}},"required":["stack","type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform being targeted"},"stack":{"type":"string","description":"Name of the stack being checked"},"type":{"type":"string","enum":["RunningPreflights"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"targetTriple":{"type":"string","description":"Target triple for the runtime"},"type":{"type":"string","enum":["DownloadingAlienRuntime"]},"url":{"type":"string","description":"URL being downloaded from"}},"required":["targetTriple","type","url"]},{"type":"object","properties":{"relatedResources":{"type":"array","items":{"type":"string"},"description":"All resource names sharing this build (for deduped container groups)"},"resourceName":{"type":"string","description":"Name of the resource being built"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["BuildingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being built"},"type":{"type":"string","enum":["BuildingImage"]}},"required":["image","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being pushed"},"progress":{"oneOf":[{"type":"object","properties":{"bytesUploaded":{"type":"integer","minimum":0,"description":"Bytes uploaded so far"},"layersUploaded":{"type":"integer","minimum":0,"description":"Number of layers uploaded so far"},"operation":{"type":"string","description":"Current operation being performed"},"totalBytes":{"type":"integer","minimum":0,"description":"Total bytes to upload"},"totalLayers":{"type":"integer","minimum":0,"description":"Total number of layers to upload"}},"required":["bytesUploaded","layersUploaded","operation","totalBytes","totalLayers"],"description":"Progress information for image push operations"},{"nullable":true}]},"type":{"type":"string","enum":["PushingImage"]}},"required":["image","type"]},{"type":"object","properties":{"destination":{"type":"string","nullable":true,"description":"Human-readable destination for pushed images"},"platform":{"type":"string","description":"Target platform"},"stack":{"type":"string","description":"Name of the stack being pushed"},"type":{"type":"string","enum":["PushingStack"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"resourceName":{"type":"string","description":"Name of the resource being pushed"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["PushingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"project":{"type":"string","description":"Project name"},"type":{"type":"string","enum":["CreatingRelease"]}},"required":["project","type"]},{"type":"object","properties":{"language":{"type":"string","description":"Language being compiled (rust, typescript, etc.)"},"progress":{"type":"string","nullable":true,"description":"Current progress/status line from the build output"},"type":{"type":"string","enum":["CompilingCode"]}},"required":["language","type"]},{"type":"object","properties":{"nextState":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},"suggestedDelayMs":{"type":"integer","nullable":true,"minimum":0,"description":"An suggested duration to wait before executing the next step."},"type":{"type":"string","enum":["StackStep"]}},"required":["nextState","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["GeneratingCloudFormationTemplate"]}},"required":["type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform for which the template is being generated"},"type":{"type":"string","enum":["GeneratingTemplate"]}},"required":["platform","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being provisioned"},"releaseId":{"type":"string","description":"ID of the release being deployed to the agent"},"type":{"type":"string","enum":["ProvisioningAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being updated"},"releaseId":{"type":"string","description":"ID of the new release being deployed to the agent"},"type":{"type":"string","enum":["UpdatingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being deleted"},"releaseId":{"type":"string","description":"ID of the release that was running on the agent"},"type":{"type":"string","enum":["DeletingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being debugged"},"debugSessionId":{"type":"string","description":"ID of the debug session"},"type":{"type":"string","enum":["DebuggingAgent"]}},"required":["agentId","debugSessionId","type"]},{"type":"object","properties":{"strategyName":{"type":"string","description":"Name of the deployment strategy being used"},"type":{"type":"string","enum":["PreparingEnvironment"]}},"required":["strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being deployed"},"type":{"type":"string","enum":["DeployingStack"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being tested"},"type":{"type":"string","enum":["RunningTestWorker"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpStack"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpEnvironment"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"platformName":{"type":"string","description":"Name of the platform (e.g., \"AWS\", \"GCP\")"},"type":{"type":"string","enum":["SettingUpPlatformContext"]}},"required":["platformName","type"]},{"type":"object","properties":{"repositoryName":{"type":"string","description":"Name of the docker repository"},"type":{"type":"string","enum":["EnsuringDockerRepository"]}},"required":["repositoryName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeployingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"roleArn":{"type":"string","description":"ARN of the role to assume"},"type":{"type":"string","enum":["AssumingRole"]}},"required":["roleArn","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"type":{"type":"string","enum":["ImportingStackStateFromCloudFormation"]}},"required":["cfnStackName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeletingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"bucketNames":{"type":"array","items":{"type":"string"},"description":"Names of the S3 buckets being emptied"},"type":{"type":"string","enum":["EmptyingBuckets"]}},"required":["bucketNames","type"]},{"type":"object","properties":{"deploymentGroupId":{"type":"string","description":"ID of the deployment group this slot belongs to"},"deploymentId":{"type":"string","description":"ID of the deployment that was created"},"releaseId":{"type":"string","nullable":true,"description":"Initial release the slot was created with, if any"},"type":{"type":"string","enum":["DeploymentCreated"]}},"required":["deploymentGroupId","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously live, if any"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentReleased"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release the platform was trying to deploy, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"phase":{"type":"string","enum":["preflights","provisioning","updating","deleting"],"description":"Phase of a deployment at which a failure occurred.\n\nDerived from the source deployment status: `preflights-failed` →\n`Preflights`, `provisioning-failed` → `Provisioning`, `update-failed` →\n`Updating`, `delete-failed` → `Deleting`.\n`refresh-failed` is modelled separately via `DeploymentDegraded`."},"type":{"type":"string","enum":["DeploymentFailed"]}},"required":["deploymentId","error","phase","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"type":{"type":"string","enum":["DeploymentDegraded"]}},"required":["deploymentId","error","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentRecovered"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment that was deleted"},"type":{"type":"string","enum":["DeploymentDeleted"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Name of the channel that moved"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously current, if any"},"releaseId":{"type":"string","description":"ID of the release that is now current"},"type":{"type":"string","enum":["ReleaseChannelUpdated"]}},"required":["channel","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Newly followed channel"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousChannel":{"type":"string","description":"Previously followed channel"},"type":{"type":"string","enum":["DeploymentReleaseChannelChanged"]}},"required":["channel","deploymentId","previousChannel","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release that the failed attempt was targeting, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousError":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"type":{"type":"string","enum":["DeploymentRetryRequested"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release being redeployed"},"type":{"type":"string","enum":["DeploymentRedeployRequested"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"pinnedReleaseId":{"type":"string","description":"ID of the release that is now pinned"},"previousPinnedReleaseId":{"type":"string","nullable":true,"description":"ID of the previously pinned release, if any"},"type":{"type":"string","enum":["DeploymentReleasePinned"]}},"required":["deploymentId","pinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousPinnedReleaseId":{"type":"string","description":"ID of the release that was previously pinned"},"type":{"type":"string","enum":["DeploymentReleaseUnpinned"]}},"required":["deploymentId","previousPinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"changedKeys":{"type":"array","items":{"type":"string"},"description":"Names of the environment variables that changed (added, removed, or modified)"},"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentEnvironmentUpdated"]}},"required":["changedKeys","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentDeletionRequested"]}},"required":["deploymentId","type"]},{"$ref":"#/components/schemas/DeploymentCredentialRotationEvent"}]},"state":{"oneOf":[{"type":"object","properties":{"failed":{"type":"object","properties":{"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]}},"description":"Event failed with an error"}},"required":["failed"]},{"type":"string","enum":["none"]},{"type":"string","enum":["started"]},{"type":"string","enum":["success"]}],"description":"Represents the state of an event"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","data","state","projectId","createdAt","workspaceId"]},"DeploymentCredentialRotationEvent":{"type":"object","properties":{"type":{"type":"string","enum":["DeploymentCredentialRotation"]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"rotationId":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"previousKeyId":{"type":"string"},"candidateKeyId":{"type":"string"},"actor":{"type":"object","properties":{"kind":{"type":"string","enum":["user","serviceAccount"]},"id":{"type":"string"}},"required":["kind","id"]}},"required":["type","deploymentId","rotationId","revision","status","previousKeyId","candidateKeyId","actor"]},"GenerateManagerTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string","description":"Platform JWT for authenticating with the manager"},"expiresIn":{"type":"number","nullable":true,"description":"Token lifetime in seconds"},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","description":"Manager URL for direct access"},"databaseId":{"type":"string","nullable":true,"description":"Log database ID (null if logs not configured)"},"controlPlaneUrl":{"type":"string","nullable":true,"description":"Log control plane URL (null if logs not configured)"}},"required":["accessToken","expiresIn","tokenType","managerUrl","databaseId","controlPlaneUrl"]},"GenerateManagerTokenRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to scope token access to."}},"required":["project"]},"GenerateManagerBindingTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string"}},"required":["accessToken","expiresIn","tokenType","managerUrl"]},"GenerateManagerBindingTokenRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"kind":{"type":"string","enum":["data","sandbox"],"description":"Binding kind the token resolves. Defaults to the deployment's own kind: sandbox for a sandbox deployment, data otherwise."}},"required":["deploymentId"],"additionalProperties":false},"ResolveManagerGcpOAuthProviderResponse":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId","clientSecret"]}]},"ResolveManagerGcpOAuthProviderRequest":{"type":"object","properties":{"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group bearer token whose project-level OAuth provider should be resolved."},"returnOrigin":{"type":"string","format":"uri","description":"Browser origin that will receive the Google OAuth callback result. Must be a first-party dashboard origin or the active portal origin for the deployment group's project."}},"required":["deploymentGroupToken"]},"ManagerHeartbeatResponse":{"type":"object","properties":{"acknowledged":{"type":"boolean"},"timestamp":{"type":"string"}},"required":["acknowledged","timestamp"]},"ManagerHeartbeatRequest":{"type":"object","properties":{"status":{"type":"string","enum":["healthy","degraded","unhealthy"],"description":"Current health status"},"version":{"type":"string","description":"Manager version"},"url":{"type":"string","format":"uri","description":"Manager public URL (for accessing DeepStore endpoints)"},"managementConfigs":{"allOf":[{"$ref":"#/components/schemas/ManagerManagementConfigs"},{"description":"Per-platform management configurations for cross-account access"}]},"metrics":{"type":"object","properties":{"activeDeployments":{"type":"number"},"pendingDeployments":{"type":"number"},"memoryUsageMb":{"type":"number"},"cpuUsagePercent":{"type":"number"}},"description":"Optional runtime metrics"}},"required":["status","url","managementConfigs"]},"ManagerDeployment":{"type":"object","properties":{"platform":{"type":"string","description":"Platform of the internal deployment"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status of the internal deployment"},"deploymentId":{"type":"string","description":"Internal deployment ID"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Currently deployed private manager release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Target private manager release for an in-progress update","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"error":{"nullable":true,"description":"Latest provision / upgrade / delete error"},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type"},"status":{"type":"string","description":"Resource status"},"outputs":{"type":"object","additionalProperties":{"nullable":true},"description":"Resource outputs"}},"required":["type","status"]},"description":"Simplified stack state resources"},"environmentInfo":{"nullable":true,"description":"Manager environment info"}},"required":["platform","status","deploymentId","resources"]},"ContainerRegistryManagerSnapshot":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"routes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string"},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"routableUpstreamName":{"type":"string","nullable":true},"remoteResourceRevision":{"type":"string"}},"required":["id","logicalName","desiredState","routableUpstreamName","remoteResourceRevision"],"additionalProperties":false}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"secretPrefix":{"type":"string"},"secretDigest":{"type":"string","pattern":"^[0-9a-f]{64}$"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","secretPrefix","secretDigest","scope","repositorySubset","expiresAt","revokedAt"],"additionalProperties":false}}},"required":["id","deploymentId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","repositories","credentials"],"additionalProperties":false}}},"required":["generatedAt","routes"],"additionalProperties":false},"ApplyContainerRegistrySnapshotResponse":{"type":"object","properties":{"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["applying","connected","degraded","revoked"]}},"required":["appliedRevision","status"],"additionalProperties":false},"PrepareOperatorManifestPackageResponse":{"type":"object","properties":{"package":{"$ref":"#/components/schemas/Package"}},"required":["package"]},"PrepareOperatorManifestPackageRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}},"required":["project"],"additionalProperties":false},"RenderOperatorManifestResponse":{"type":"object","properties":{"manifest":{"type":"string","description":"Rendered multi-document Kubernetes manifest"},"applyCommand":{"type":"string","description":"kubectl command for applying the manifest from a file"},"filename":{"type":"string","description":"Suggested local filename"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the manifest"},"imagePending":{"type":"boolean","description":"True when the operator image is still building. The manifest contains a placeholder image (<PENDING_IMAGE>) and must not be applied yet — re-render once the operator-image package is ready to get the real image."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["manifest","applyCommand","filename","managerUrl","imagePending","operatorImage"]},"RenderOperatorManifestRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"format":{"type":"string","enum":["raw","helm"],"default":"raw","description":"raw: a kubectl-applyable manifest for one cluster. helm: a paste-into-your-chart template whose namespace and environment name come from Helm at install time."},"environmentName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Per-environment identity. Required for raw output, ignored for helm.","example":"my-app"},"namespace":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([-a-z0-9]*[a-z0-9])?$","description":"Namespace to observe and install into. Omit for helm to use the release namespace."},"scope":{"type":"string","enum":["namespace","cluster"],"default":"namespace","description":"namespace: a namespaced Role that manages the install namespace. cluster: a ClusterRole that manages every namespace."},"labelSelector":{"type":"string","minLength":1,"maxLength":256,"description":"Optional Kubernetes label selector narrowing what is managed, applied within the scope."},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to use for the Operator image. If omitted, the latest ready operator-image package for the project is used.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group token embedded in the operator Secret"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","default":false},"podLabelKey":{"type":"string","minLength":1,"description":"Existing Pod label key to collect logs from. Set with podLabelValue."},"podLabelValue":{"type":"string","minLength":1,"description":"Existing Pod label value to collect logs from. Set with podLabelKey."}},"description":"Enable the node log collector DaemonSet for raw pod logs."},"stackSettings":{"$ref":"#/components/schemas/StackSettings"}},"required":["project","deploymentGroupToken"],"additionalProperties":false},"StackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"EcsBootstrapWriteCheckRequest":{"type":"object","properties":{"stackName":{"type":"string","pattern":"^[A-Za-z][A-Za-z0-9-]{0,127}$"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"}},"required":["stackName","accountId","region","clusterArn"],"additionalProperties":false},"RenderOperatorEcsCloudFormationResponse":{"type":"object","properties":{"template":{"type":"string","nullable":true,"description":"CloudFormation JSON for an ECS Fargate service, or null while the immutable Operator image is building. The artifact contains no bootstrap credential values."},"filename":{"type":"string","description":"Suggested local CloudFormation filename"},"stackName":{"type":"string","description":"Suggested stack name for this installation"},"deployCommand":{"type":"string","nullable":true,"description":"Local bash/zsh deploy command, or null while the image is building. Before writing a bootstrap secret, it asks Alien to verify the one-time setup token and registration state, then preserves or generates the encryption key and writes both to customer-owned Secrets Manager. Once an Operator has registered from this stack, it reuses the stored secret at its current version and never asks for a token. It passes only the secret ARN and version ID to CloudFormation."},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the task definition"},"image":{"type":"string","description":"Immutable Operator image reference, or <PENDING_IMAGE>"},"imagePending":{"type":"boolean","description":"True until a ready Operator image digest is available. A pending template must not be deployed."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["template","filename","stackName","deployCommand","managerUrl","image","imagePending","operatorImage"]},"RenderOperatorEcsCloudFormationRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"environmentName":{"type":"string","minLength":2,"maxLength":100,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Stable per-environment Remote Operator installation name"},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"},"subnetIds":{"type":"array","items":{"type":"string","pattern":"^subnet-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact subnet ID for an Operator task ENI"},"minItems":1,"maxItems":16},"securityGroupIds":{"type":"array","items":{"type":"string","pattern":"^sg-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact security group ID for an Operator task ENI"},"minItems":1,"maxItems":16},"assignPublicIp":{"type":"string","enum":["DISABLED","ENABLED"],"default":"DISABLED"},"efsFileSystemId":{"type":"string","pattern":"^fs-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS filesystem ID for the Operator identity. Omit it, with efsAccessPointId, to have the stack create retained EFS storage."},"efsAccessPointId":{"type":"string","pattern":"^fsap-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS access point ID (POSIX UID and GID 1000) on efsFileSystemId. Supply it together with efsFileSystemId."},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to pin in the task definition. If omitted, the current project package is prepared or reused.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"s3BucketArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$","description":"Exact ARN of an S3 bucket the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned S3 ceiling. Required when enabled S3 operations need ListBucket or GetObject; the generated role contains only these bucket and object ARNs."},"sqsQueueArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):sqs:[a-z0-9]+(?:-[a-z0-9]+)+:[0-9]{12}:(?:[A-Za-z0-9_-]{1,80}|[A-Za-z0-9_-]{1,75}\\.fifo)$","description":"Exact ARN of an SQS queue the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned SQS ceiling. Required when enabled SQS operations read queue attributes; the generated role contains only these queue ARNs."}},"required":["project","environmentName","accountId","region","clusterArn","subnetIds","securityGroupIds"],"additionalProperties":false},"APIKey":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"},"createdByUser":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"email":{"type":"string"},"image":{"type":"string","nullable":true}},"required":["id","email","image"],"description":"User information associated with the API key"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig","createdByUser"],"description":"API key information"},"APIKeyDeploymentSetupConfig":{"type":"object","nullable":true,"properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/APIKeyDeploymentSetupEnvironmentVariable"}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8}},"required":["metadata","policy","environmentVariables"]},"APIKeyDeploymentSetupEnvironmentVariable":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]},"CreateAPIKeyResponse":{"type":"object","properties":{"apiKey":{"type":"string","description":"The generated API key value (only shown once)"},"keyInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig"]}},"required":["apiKey","keyInfo"],"description":"Response containing the new API key and its metadata"},"CreateAPIKeyRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"scope":{"$ref":"#/components/schemas/Scope"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"required":["description","scope","expiresAt"],"description":"Request schema for creating a new API key"},"Scope":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceScope"},{"$ref":"#/components/schemas/ProjectScope"},{"$ref":"#/components/schemas/DeploymentScope"},{"$ref":"#/components/schemas/DeploymentGroupScope"},{"$ref":"#/components/schemas/ManagerScope"}],"discriminator":{"propertyName":"type","mapping":{"workspace":"#/components/schemas/WorkspaceScope","project":"#/components/schemas/ProjectScope","deployment":"#/components/schemas/DeploymentScope","deployment-group":"#/components/schemas/DeploymentGroupScope","manager":"#/components/schemas/ManagerScope"}},"description":"Scope and role configuration for service accounts"},"WorkspaceScope":{"type":"object","properties":{"type":{"type":"string","enum":["workspace"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["type","role"],"description":"Workspace-scoped configuration"},"ProjectScope":{"type":"object","properties":{"type":{"type":"string","enum":["project"]},"projectId":{"type":"string","description":"ID of the project this is scoped to"},"role":{"$ref":"#/components/schemas/ProjectRole"}},"required":["type","projectId","role"],"description":"Project-scoped configuration"},"DeploymentScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment"]},"deploymentId":{"type":"string","description":"ID of the deployment this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"},"role":{"$ref":"#/components/schemas/DeploymentRole"}},"required":["type","deploymentId","projectId","role"],"description":"Deployment-scoped configuration"},"DeploymentGroupScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"]},"deploymentGroupId":{"type":"string","description":"ID of the deployment group this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"},"role":{"$ref":"#/components/schemas/DeploymentGroupRole"}},"required":["type","deploymentGroupId","projectId","role"],"description":"Deployment group-scoped configuration"},"ManagerScope":{"type":"object","properties":{"type":{"type":"string","enum":["manager"]},"managerId":{"type":"string","description":"ID of the manager this is scoped to"},"role":{"$ref":"#/components/schemas/ManagerRole"}},"required":["type","managerId","role"],"description":"Manager-scoped configuration"},"UpdateAPIKeyRequest":{"type":"object","properties":{"enabled":{"type":"boolean"},"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"deploymentSetupConfig":{"$ref":"#/components/schemas/UpdateDeploymentSetupPolicy"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"description":"Request schema for updating an API key"},"UpdateDeploymentSetupPolicy":{"type":"object","properties":{"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"}},"required":["policy"],"description":"Editable part of a deployment link's setup config. Locked env vars and input values are preserved."},"DeleteAPIKeysRequest":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"minItems":1}},"required":["ids"]},"DomainWithUsage":{"allOf":[{"$ref":"#/components/schemas/Domain"},{"type":"object","properties":{"endpoints":{"type":"array","items":{"$ref":"#/components/schemas/DomainEndpoint"}},"usage":{"type":"object","properties":{"deploymentUrlProjects":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"portalBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true},"hostname":{"type":"string"}},"required":["id","projectId","projectName","hostname"]}},"packageDomains":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"hostname":{"type":"string"}},"required":["id","hostname"]}},"managerBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"managerId":{"type":"string"},"managerName":{"type":"string"},"hostname":{"type":"string"}},"required":["id","managerId","managerName","hostname"]}}},"required":["deploymentUrlProjects","portalBindings","packageDomains","managerBindings"]}},"required":["endpoints","usage"]}]},"Domain":{"type":"object","properties":{"id":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domain":{"type":"string"},"isSystem":{"type":"boolean"},"claimToken":{"type":"string"},"hostedZoneId":{"type":"string","nullable":true},"nameServers":{"type":"array","nullable":true,"items":{"type":"string"}},"status":{"type":"string","enum":["pending-zone-creation","pending-verification","verified","lost-verification","failed","deleting"]},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verifiedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","workspaceId","domain","isSystem","claimToken","status","createdAt","updatedAt"]},"EventListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Event"},{"type":"object","properties":{"releaseCreatedAt":{"type":"string","format":"date-time","nullable":true,"description":"createdAt of the event's referenced release, included when ?include=releaseCreatedAt is used"}}}]},"IncidentListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Incident"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"],"additionalProperties":false},"Incident":{"type":"object","properties":{"id":{"type":"string"},"number":{"type":"integer","minimum":0,"exclusiveMinimum":true},"reference":{"type":"string"},"title":{"type":"string"},"scopeLabel":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true},"sessionStatus":{"type":"string","nullable":true,"enum":["queued","running","halted","complete","error","canceled",null]},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","number","reference","title","scopeLabel","agentSessionId","sessionStatus","projectId","deploymentId","releaseId","createdAt","updatedAt"],"additionalProperties":false},"IncidentResponse":{"type":"object","properties":{"incident":{"$ref":"#/components/schemas/Incident"}},"required":["incident"],"additionalProperties":false},"ListMachinesJoinTokensResponse":{"type":"object","properties":{"tokens":{"type":"array","items":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"}}},"required":["tokens"]},"MachinesJoinTokenSummary":{"type":"object","properties":{"id":{"type":"string"},"createdAt":{"type":"string"},"createdBy":{"type":"string"},"expiresAt":{"type":"string","nullable":true},"maxJoins":{"type":"integer","nullable":true},"joinCount":{"type":"integer"},"lastUsedAt":{"type":"string","nullable":true},"revokedAt":{"type":"string","nullable":true}},"required":["id","createdAt","createdBy","joinCount"]},"CreateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RotateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RevokeMachinesJoinTokenResponse":{"type":"object","properties":{"tokenId":{"type":"string"},"revoked":{"type":"boolean"}},"required":["tokenId","revoked"]},"CancelMachinesMachineDrainResponse":{"type":"object","properties":{"machineId":{"type":"string"},"cancelled":{"type":"boolean"}},"required":["machineId","cancelled"]},"DrainMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"requested":{"type":"boolean"}},"required":["machineId","requested"]},"DrainMachinesMachineRequest":{"type":"object","properties":{"deadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"force":{"type":"boolean"}}},"RemoveMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"removed":{"type":"boolean"}},"required":["machineId","removed"]},"CommandBootstrapResponse":{"type":"object","properties":{"managerUrl":{"type":"string","format":"uri","description":"Current customer-facing manager URL"},"token":{"type":"string","minLength":1,"description":"Short-lived command capability token"},"expiresAt":{"type":"string","format":"date-time","description":"Capability expiry in RFC 3339 format"},"target":{"$ref":"#/components/schemas/CommandReceiverBootstrapTarget"}},"required":["managerUrl","token","expiresAt"]},"CommandReceiverBootstrapTarget":{"type":"object","properties":{"resourceId":{"type":"string"},"resourceType":{"type":"string","enum":["container","daemon"]}},"required":["resourceId","resourceType"],"description":"Resolved target identity; present only for receiver bootstrap"},"CommandBootstrapRequest":{"oneOf":[{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["sender"]}},"required":["deploymentId","role"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["receiver"]},"target":{"type":"string","minLength":1,"maxLength":255}},"required":["deploymentId","role","target"],"additionalProperties":false}]},"CommandListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Command"},{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/CommandDeploymentInfo"},"project":{"$ref":"#/components/schemas/CommandProjectInfo"}}}]},"CommandVerification":{"type":"object","nullable":true,"properties":{"state":{"type":"string","enum":["not-required","pending","verified","failed","skipped"],"description":"Verification outcome of an operation command."},"reason":{"type":"string","nullable":true,"description":"Present for 'failed' and 'skipped'."}},"required":["state","reason"],"description":"Verification outcome of an operation command; null for commands that are not operations"},"CommandDeploymentInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/CommandDeploymentGroupInfo"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"managerId":{"type":"string","description":"Manager ID for obtaining access tokens"},"managerUrl":{"type":"string","nullable":true,"format":"uri","description":"URL of the manager for direct payload access"},"managerName":{"type":"string","nullable":true,"description":"Human-readable name of the manager"},"managerIsSystem":{"type":"boolean","nullable":true,"description":"Whether the manager is Alien-hosted (system)"}},"required":["id","name","managerId"]},"CommandDeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"CommandProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string"}},"required":["id","name"]},"Command":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","description":"Command name (e.g., 'analyze-repository', 'sync-data')"},"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Command states in the Commands protocol lifecycle"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Delivery mode for this command (push/pull), derived from the target at creation time"},"target":{"type":"object","nullable":true,"properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to; null on commands created before target routing"},"attempt":{"type":"number","nullable":true,"description":"Current attempt number"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","nullable":true,"description":"Size of command params in bytes"},"responseSizeBytes":{"type":"number","nullable":true,"description":"Size of command response in bytes"},"createdAt":{"type":"string","format":"date-time","description":"When the command was created"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command was dispatched to the deployment"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command completed"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if command failed"},"accessRequestId":{"type":"string","nullable":true,"description":"The approved access request that authorized this operation command, if one did"},"verification":{"$ref":"#/components/schemas/CommandVerification"},"result":{"nullable":true,"description":"Decoded command result when available"},"resultAvailability":{"type":"string","enum":["available","protected"],"description":"Whether a successful operation result is included or withheld pending explicit confirmation"}},"required":["id","deploymentId","projectId","workspaceId","name","state","deploymentModel","target","attempt","deadline","requestSizeBytes","responseSizeBytes","createdAt","dispatchedAt","completedAt","error","accessRequestId","verification"]},"ListCommandNamesResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}}},"required":["names"]},"ListCommandDeploymentsResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"required":["id","name"]}}},"required":["deployments"]},"CreateCommandResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"projectId":{"type":"string","description":"Project ID (for manager to use in routing)"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"How to dispatch the command"},"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to"},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How the command is delivered to its target"},"operationResultContractPersisted":{"type":"boolean","description":"Whether an operation result contract was stored atomically with this command"}},"required":["id","projectId","deploymentModel","target","deliveryMode","operationResultContractPersisted"]},"CreateCommandRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Target deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":1,"maxLength":255,"description":"Command name (e.g., 'analyze-repository')"},"params":{"nullable":true,"description":"Command parameters for public invocation"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key for public invocation retries. Requires params; use null for a command without arguments. Reuse the same key and identical request to recover the original command for up to 24 hours. Scoped to the workspace, caller, deployment, resolved target, and command name. The first accepted request wins; changed params or deadlines do not create a new command with the same key. Omit for a new invocation without retry protection."},"target":{"type":"string","maxLength":255,"description":"Resource id the command is addressed to. Required when the deployment has more than one command-capable resource."},"initialState":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Initial state (PENDING_UPLOAD if params require upload, PENDING if inline)"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Size of command params in bytes"},"operationResultContract":{"nullable":true,"description":"Opaque operation result contract with an optional accessRequestId binding, forwarded by a manager and persisted atomically before dispatch"}},"required":["deploymentId","name"]},"ResolvedCommandTarget":{"type":"object","properties":{"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Identifies the specific resource a command is addressed to."},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How a command is delivered to its target resource.\n\nThis is a Commands-protocol-specific concept and is intentionally distinct\nfrom `DeploymentModel` (see `stack_settings.rs`), which governs the\ninfrastructure-level push/pull wiring for a deployment. Serialized\nlowercase for consistency with `CommandTargetType`."}},"required":["target","deliveryMode"]},"UpdateCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"New command state"},"attempt":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Current attempt number"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command was dispatched"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}}},"DispatchCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"DispatchCommandRequest":{"type":"object","properties":{"dispatchedAt":{"type":"string","format":"date-time","description":"When the command was dispatched"}},"required":["dispatchedAt"]},"CompleteCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"CompleteCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["SUCCEEDED","FAILED","EXPIRED"],"description":"Terminal state to transition to"},"completedAt":{"type":"string","format":"date-time","description":"When the command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}},"required":["state","completedAt"]},"IncrementCommandAttemptResponse":{"type":"object","properties":{"attempt":{"type":"integer","description":"The attempt number after the increment"}},"required":["attempt"]},"DebugSessionListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DebugSession"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"},"DebugSession":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"owner":{"type":"string","nullable":true,"maxLength":128},"state":{"$ref":"#/components/schemas/DebugSessionState"},"mode":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"provider":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Represents the target cloud platform."},"presignedUrls":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DebugPackagePresignedURLs"}},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","state","mode","presignedUrls","createdAt","expiresAt","deploymentId","projectId","workspaceId"]},"DebugSessionState":{"type":"string","enum":["pending","running","stopping","stopped","expired","failed"]},"DebugPackagePresignedURLs":{"type":"object","properties":{"readUrl":{"type":"string","maxLength":2048,"format":"uri"},"writeUrl":{"type":"string","maxLength":2048,"format":"uri"}},"required":["readUrl","writeUrl"]},"CreateDebugSessionRequest":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Override the generated id. Manager passes the registry session id so logs correlate.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"owner":{"type":"string","nullable":true,"maxLength":128},"expiresAt":{"type":"string","format":"date-time"},"state":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Initial state. Defaults to 'pending'."}]},"accessRequestId":{"type":"string","description":"The caller's own access request whose debug grant authorized this session, for the same deployment."}},"required":["deploymentId","expiresAt"]},"UpdateDebugSessionRequest":{"type":"object","properties":{"state":{"$ref":"#/components/schemas/DebugSessionState"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"expiresAt":{"type":"string","format":"date-time"}}},"DeploymentInfo":{"type":"object","properties":{"setupUpdate":{"type":"object","properties":{"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"releaseId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"}],"nullable":true},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"}],"nullable":true},"setupTarget":{"type":"string","nullable":true},"resourcePrefix":{"type":"string","nullable":true},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["deploymentId","updateOperationId","releaseId","name","platform","setupMethod","setupMetadata","setupTarget","resourcePrefix","stackSettings"]},"tokenType":{"type":"string","enum":["deployment","deployment-group"],"description":"Type of token used to authenticate this request"},"deployment":{"type":"object","properties":{"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["name","platform"],"description":"Deployment details (present when using a deployment-scoped token)"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"pinnedSubdomain":{"type":"string","nullable":true}},"required":["id","name","pinnedSubdomain"],"description":"Deployment group details (present when using a deployment-group token)"},"workspace":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"avatarUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name"]},"project":{"type":"object","properties":{"name":{"type":"string"},"portal":{"type":"object","properties":{"appearance":{"$ref":"#/components/schemas/DeploymentPortalAppearance"}},"required":["appearance"]},"stackSummary":{"type":"object","nullable":true,"properties":{"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms supported by the active release"},"requiresNetwork":{"type":"boolean","description":"Whether the stack contains resources that require cloud VPC networking"},"customerModels":{"type":"boolean","description":"Whether this release offers one remotely accessible AI resource"},"resourceCounts":{"type":"object","properties":{"workers":{"type":"integer","minimum":0},"containers":{"type":"integer","minimum":0},"daemons":{"type":"integer","minimum":0,"description":"Daemon resources that run on managed runtime machines"},"publicHttpsEndpoints":{"type":"integer","minimum":0,"description":"Resources that declare managed public HTTPS endpoint setup"},"externalInfra":{"type":"integer","minimum":0,"description":"Storage, queue, KV, vault, database, or cache resources that Kubernetes needs Terraform to provision"},"total":{"type":"integer","minimum":0}},"required":["workers","containers","publicHttpsEndpoints","externalInfra","total"]},"publicEndpoints":{"type":"array","items":{"type":"object","properties":{"resourceId":{"type":"string"},"endpointName":{"type":"string"},"hostLabel":{"type":"string"},"wildcardSubdomains":{"type":"boolean"}},"required":["resourceId","endpointName","hostLabel","wildcardSubdomains"]},"description":"Public endpoints declared by the active release stack"}},"required":["platforms","requiresNetwork","customerModels","resourceCounts","publicEndpoints"]},"generatedDomain":{"type":"object","nullable":true,"properties":{"domain":{"type":"string"},"isSystem":{"type":"boolean"}},"required":["domain","isSystem"],"description":"Parent domain for generated deployment URLs. Chosen public subdomains are only allowed when isSystem is false."}},"required":["name","portal"]},"packages":{"type":"object","properties":{"ready":{"type":"boolean","description":"True if all enabled packages are ready for deployment"},"cli":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"commandName":{"type":"string","description":"CLI command name to use in install instructions"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},"error":{"nullable":true},"installScripts":{"type":"object","properties":{"windows":{"type":"string","format":"uri"},"mac":{"type":"string","format":"uri"},"linux":{"type":"string","format":"uri"}},"required":["windows","mac","linux"],"description":"Install script URLs for each OS"}},"required":["status","commandName","installScripts"]},"cloudformation":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},"error":{"nullable":true},"mode":{"type":"string","enum":["auto","outputs"]},"launchUrl":{"type":"string","format":"uri","description":"CloudFormation launch URL"},"outputsSchema":{"nullable":true}},"required":["status","mode","launchUrl"]},"terraform":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},"error":{"nullable":true},"providerSource":{"type":"string","description":"Terraform provider source (without https://)"},"moduleSources":{"type":"object","additionalProperties":{"type":"string"},"description":"Terraform module sources by target"},"moduleVersion":{"type":"string"},"managerUrls":{"type":"object","additionalProperties":{"type":"string"},"description":"Manager URLs by Terraform target"}},"required":["status","providerSource","moduleSources","managerUrls"]},"helm":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},"error":{"nullable":true},"chartRef":{"type":"string","description":"OCI chart reference"},"managerUrlOverride":{"type":"string","format":"uri","description":"Management endpoint to supply only when this chart's captured default differs from current installation routing."},"managerFetchExample":{"type":"string"},"localImportExample":{"type":"string"}},"required":["status","chartRef"]}},"required":["ready"]},"installContext":{"type":"object","properties":{"targets":{"type":"object","additionalProperties":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managerUrl":{"type":"string","format":"uri"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"awsManagingAccountId":{"type":"string"}},"required":["platform","managerUrl"]},"description":"Deployment-session install context by Terraform/installer target"}},"required":["targets"]},"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"},"modelAvailabilitySources":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"status":{"type":"string","enum":["current","stale","invalid"]},"availability":{"$ref":"#/components/schemas/AiAvailabilityObservation"}},"required":["deploymentId","resourceId","observedAt","status"]}},"setupItems":{"type":"array","items":{"$ref":"#/components/schemas/SetupItemStatus"}},"setupConfig":{"$ref":"#/components/schemas/DeploymentInfoSetupConfig"},"readiness":{"type":"object","properties":{"status":{"type":"string","enum":["ready","notReady","unknown"]},"checks":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"status":{"type":"string","enum":["passed","failed","warning","unknown"]},"message":{"type":"string"},"checkedAt":{"type":"string"}},"required":["code","status","message","checkedAt"]}}},"required":["status","checks"]}},"required":["tokenType","workspace","project","packages","installContext","supportedRegions","modelAvailabilitySources"]},"DeploymentPortalAppearance":{"type":"object","properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}}},"SupportedCloudRegions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by this Alien environment."},"gcp":{"type":"array","items":{"type":"string"},"description":"GCP regions supported by this Alien environment."},"azure":{"type":"array","items":{"type":"string"},"description":"Azure locations supported by this Alien environment."}},"required":["aws","gcp","azure"]},"AiAvailabilityObservation":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"SetupItemStatus":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false},"status":{"type":"string","enum":["not-started","waiting","applying","verifying","connected","needs-attention","revoked"]},"deploymentIds":{"type":"array","items":{"type":"string"}},"blocker":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]}},"required":["item","source","required","status","deploymentIds"],"additionalProperties":false},"DeploymentInfoSetupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"inputValues":{"type":"array","items":{"$ref":"#/components/schemas/ResolvedStackInputSummary"}}},"required":["metadata","policy","environmentVariables"]},"ResolvedStackInputSummary":{"type":"object","properties":{"id":{"type":"string"},"label":{"type":"string"},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"]}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"provided":{"type":"boolean"}},"required":["id","label","providedBy","required","secret","provided"]},"DeploymentComputePlan":{"type":"object","properties":{"pools":{"type":"array","items":{"type":"object","properties":{"poolId":{"type":"string"},"workloads":{"type":"array","items":{"type":"string"}},"requirements":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"scale":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["fixed"]},"machines":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","machines"]},{"type":"object","properties":{"type":{"type":"string","enum":["autoscale"]},"min":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]},"max":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","min","max"]}]},"selected":{"$ref":"#/components/schemas/ComputePoolSelection"},"recommended":{"$ref":"#/components/schemas/ComputePoolSelection"},"machines":{"type":"array","items":{"type":"object","properties":{"machine":{"type":"string"},"profile":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"recommended":{"type":"boolean"}},"required":["machine","profile","recommended"]}},"errors":{"type":"array","items":{"type":"string"}}},"required":["poolId","workloads","requirements","scale","selected","recommended","machines"]}}},"required":["pools"]},"ComputePoolSelection":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"PreparedDeploymentStack":{"type":"object","properties":{"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"setup":{"$ref":"#/components/schemas/SetupFingerprintInfo"}},"required":["platform","stack","setup"]},"SlackInstallUrlResponse":{"type":"object","properties":{"url":{"type":"string","format":"uri"}},"required":["url"]},"SlackIntegrationStatus":{"type":"object","properties":{"connected":{"type":"boolean"},"slackTeamId":{"type":"string","nullable":true},"slackTeamName":{"type":"string","nullable":true},"installedByUserId":{"type":"string","nullable":true},"installedAt":{"type":"string","nullable":true},"notificationChannelId":{"type":"string","nullable":true}},"required":["connected","slackTeamId","slackTeamName","installedByUserId","installedAt","notificationChannelId"]},"SlackChannelsResponse":{"type":"object","properties":{"channels":{"type":"array","items":{"$ref":"#/components/schemas/SlackChannel"}}},"required":["channels"]},"SlackChannel":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"isMember":{"type":"boolean"}},"required":["id","name","isMember"]},"SlackNotificationChannelResponse":{"type":"object","properties":{"notificationChannelId":{"type":"string","nullable":true},"warning":{"type":"string","nullable":true}},"required":["notificationChannelId","warning"]},"SlackNotificationChannelRequest":{"type":"object","properties":{"channelId":{"type":"string","nullable":true}},"required":["channelId"]},"AgentSessionListResponse":{"type":"object","properties":{"sessions":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionListItem"}}},"required":["sessions"]},"AgentSessionListItem":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"subjectId":{"type":"string"},"subject":{"$ref":"#/components/schemas/AgentSessionSubject"},"status":{"type":"string"},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","triggerType","subjectId","subject","status","createdAt","updatedAt"]},"AgentSessionSubject":{"type":"object","properties":{"deploymentName":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"releaseCommitMessage":{"type":"string","nullable":true},"releaseCommitRef":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true}},"required":["deploymentName","deploymentGroupId","deploymentGroupName","releaseId","releaseCommitMessage","releaseCommitRef","projectId","projectName"]},"AgentSessionDetail":{"allOf":[{"$ref":"#/components/schemas/AgentSessionListItem"},{"type":"object","properties":{"resultText":{"type":"string","nullable":true},"toolNames":{"type":"array","nullable":true,"items":{"type":"string"}},"error":{"type":"string","nullable":true}},"required":["resultText","toolNames","error"]}]},"AgentSessionEventsResponse":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionEvent"}},"latestSeq":{"type":"number"},"hasMore":{"type":"boolean"}},"required":["events","latestSeq","hasMore"]},"AgentSessionEvent":{"oneOf":[{"$ref":"#/components/schemas/AgentSessionStatusEvent"},{"$ref":"#/components/schemas/AgentSessionStepEvent"},{"$ref":"#/components/schemas/AgentSessionToolCallEvent"},{"$ref":"#/components/schemas/AgentSessionToolResultEvent"},{"$ref":"#/components/schemas/AgentSessionMarkdownEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalRequestedEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalGrantedEvent"},{"$ref":"#/components/schemas/AgentSessionRestartedEvent"},{"$ref":"#/components/schemas/AgentSessionEventsTruncatedEvent"}],"discriminator":{"propertyName":"type","mapping":{"status":"#/components/schemas/AgentSessionStatusEvent","step":"#/components/schemas/AgentSessionStepEvent","tool_call":"#/components/schemas/AgentSessionToolCallEvent","tool_result":"#/components/schemas/AgentSessionToolResultEvent","markdown":"#/components/schemas/AgentSessionMarkdownEvent","approval_requested":"#/components/schemas/AgentSessionApprovalRequestedEvent","approval_granted":"#/components/schemas/AgentSessionApprovalGrantedEvent","session_restarted":"#/components/schemas/AgentSessionRestartedEvent","events_truncated":"#/components/schemas/AgentSessionEventsTruncatedEvent"}}},"AgentSessionStatusEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["status"]},"payload":{"type":"object","properties":{"status":{"type":"string"},"error":{"type":"string"}},"required":["status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStepEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["step"]},"payload":{"type":"object","properties":{"stepId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["in_progress","complete","error"]}},"required":["stepId","title","status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolCallEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolResultEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_result"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string","nullable":true},"toolName":{"type":"string","nullable":true},"ok":{"type":"boolean"},"output":{"nullable":true}},"required":["toolCallId","toolName","ok"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionMarkdownEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["markdown"]},"payload":{"type":"object","properties":{"text":{"type":"string"}},"required":["text"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalRequestedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_requested"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["approvalId","toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalGrantedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_granted"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"approvedByUserId":{"type":"string"},"approvedByName":{"type":"string","nullable":true},"source":{"type":"string","enum":["dashboard","slack"]}},"required":["approvalId","approvedByUserId","approvedByName","source"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionRestartedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["session_restarted"]},"payload":{"type":"object","properties":{"reason":{"type":"string"}},"required":["reason"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionEventsTruncatedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["events_truncated"]},"payload":{"type":"object","properties":{"limit":{"type":"number"}},"required":["limit"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStopResponse":{"type":"object","properties":{"jobId":{"type":"string"},"status":{"type":"string"},"canceled":{"type":"boolean"}},"required":["jobId","status","canceled"]},"ListOperationsPluginsResponse":{"type":"object","properties":{"plugins":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPlugin"}},"installations":{"$ref":"#/components/schemas/OperatorInstallationsRollup"}},"required":["plugins","installations"]},"OperationsPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default tier."},"builtin":{"type":"boolean","description":"True for compiled-in plugins, false for custom bundles."},"enabled":{"type":"boolean"},"operations":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPluginOperation"}}},"required":["name","version","tier","builtin","enabled","operations"]},"OperationsPluginOperation":{"type":"object","properties":{"name":{"type":"string","description":"Operation name, unique within the plugin."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier for this operation."},"description":{"type":"string","nullable":true,"description":"Human-readable description."},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for operation parameters when the plugin publishes one."},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for a successful result when the plugin publishes one."},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string"},"pollOperation":{"type":"string"},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string"}},"successField":{"type":"string"},"successValue":{"type":"string"},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"timeoutSeconds":{"type":"integer","minimum":1}},"required":["changes","pollOperation","pollParamsFromResult","successField","successValue","timeoutSeconds"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"requiredPermissions":{"type":"array","items":{"type":"string"},"description":"IDs of permission sets (see alien-permissions) this operation requires. Empty when the operation declares none."},"permissions":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetesPermissions":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["name","tier","description","inputSchema","outputSchema","timeoutSeconds","retries","verification","sensitiveOutput","requiredPermissions","permissions"]},"OperatorInstallationsRollup":{"type":"object","properties":{"total":{"type":"integer","minimum":0,"description":"Total pull-mode installations tracked."},"ready":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["total","ready","syncing","stuck"],"description":"Rollup of this project's pull-mode installations by operations-bundle sync status, reflecting the currently enabled plugin set."},"SetBuiltinOperationsPluginsResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["names","permissionDiff"]},"OperationsPermissionDiff":{"type":"object","properties":{"aws":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change adds."},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change removes from the generated cloud configuration."}},"required":["added","removed"]},"gcp":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}}},"required":["added","removed"]},"kubernetes":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}}},"required":["added","removed"]},"incompleteForPlugins":{"type":"array","items":{"type":"string"},"description":"Previously enabled plugins whose grants could not be read before this change disabled or replaced them. Added and removed grants may be incomplete; inspect existing cloud policies before applying the regenerated configuration."}},"required":["aws","gcp","kubernetes"],"description":"Cloud permission delta versus the previously enabled set."},"OperationsAwsPermissionDiffStatement":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["effect","actions","resources","condition","sources"]},"OperationsPermissionDiffSource":{"type":"object","properties":{"plugin":{"type":"string","description":"Plugin that declared the permission."},"operation":{"type":"string","description":"Operation that declared the permission."},"reason":{"type":"string","description":"Why the operation needs this permission."}},"required":["plugin","operation","reason"]},"OperationsGcpPermissionDiffGrant":{"type":"object","properties":{"permission":{"type":"string"},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"],"description":"Where setup grants the permission: the configured project, or each Cloud Storage bucket the installer lists."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["permission","scope","sources"]},"OperationsKubernetesPermissionDiffGrant":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Empty means every resource name."},"remediationOnly":{"type":"boolean","description":"True for write verbs. The Helm chart renders them only when Operator permission is set to remediation; diagnostics installs omit them."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["apiGroup","resource","verbs","resourceNames","remediationOnly","sources"]},"SetBuiltinOperationsPluginsRequest":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"},"description":"Complete set of built-in plugins to enable."}},"required":["names"],"additionalProperties":false},"OperationsBundleUploadUrlResponse":{"type":"object","properties":{"uploadUrl":{"type":"string","format":"uri","description":"Presigned S3 PUT URL to upload the bundle ZIP to."},"uploadId":{"type":"string","description":"One-time id for this upload. Pass it back verbatim to POST /plugins so the API can validate and snapshot exactly the bytes this call uploaded."},"contentType":{"type":"string","description":"Content-Type header the PUT must send (must match the signature)."}},"required":["uploadUrl","uploadId","contentType"]},"OperationsBundleUploadUrlRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."}},"required":["name"]},"PublishOperationsPluginResponse":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","version","tier","enabled","permissionDiff"]},"PublishOperationsPluginRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."},"version":{"type":"string","minLength":1,"description":"Plugin version."},"uploadId":{"type":"string","minLength":1,"description":"The uploadId returned by POST /plugins/upload-url for the ZIP just uploaded. Identifies the exact S3 object to publish — never derived from name/version, so it can't collide with any other upload."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default risk tier."},"metadata":{"type":"object","properties":{"name":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"default":"destructive"},"binaries":{"oneOf":[{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["amd64"],"additionalProperties":false},{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["arm64"],"additionalProperties":false}]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"description":{"type":"string","nullable":true,"minLength":1},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"paramsSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"permissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"requiredPermissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1,"maximum":4294967295},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string","minLength":1,"description":"Human-readable: what this operation changes."},"pollOperation":{"type":"string","minLength":1,"description":"A read-only operation in the same plugin to poll for success."},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string","minLength":1},"default":{},"description":"Poll operation param name -> field name in the write operation's own result."},"successField":{"type":"string","minLength":1,"description":"Dotted field path in the poll result that signals success."},"successValue":{"type":"string","minLength":1,"description":"The value at successField that means verified."},"retry":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"timeoutSeconds":{"type":"integer","minimum":1,"maximum":4294967295}},"required":["changes","pollOperation","successField","successValue","timeoutSeconds"],"additionalProperties":false},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string","minLength":1},"minItems":1}},"required":["kind","fields"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"],"additionalProperties":false}]},"kubernetesPermissions":{"$ref":"#/components/schemas/KubernetesPermissions"}},"required":["name","permissions"],"additionalProperties":false},"default":[]}},"required":["name","version","binaries"],"additionalProperties":false,"description":"The complete canonical metadata.json from the uploaded bundle."}},"required":["name","version","uploadId","tier","metadata"]},"KubernetesPermissions":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/Rule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false},"Rule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/Verb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"Verb":{"type":"string","enum":["get","list","watch","delete","patch"]},"SetOperationsPluginEnabledResponse":{"type":"object","properties":{"name":{"type":"string"},"builtin":{"type":"boolean"},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","builtin","enabled","permissionDiff"]},"SetOperationsPluginEnabledRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether the plugin is distributed to this project's Operators."},"dryRun":{"type":"boolean","description":"Validate the change and return its permission delta without saving it. Defaults to false."},"expectedPermissionDiff":{"allOf":[{"$ref":"#/components/schemas/OperationsPermissionDiff"},{"description":"The permission delta the caller reviewed, usually from a dry run. When set, the change is rejected with 409 if the current delta differs."}]}},"required":["enabled"]},"OperationsPolicyResponse":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"}},"default":{"type":"string","enum":["auto","manual"],"description":"Decision for commands no rule matches."}},"required":["rules","default"]},"OperationsPolicyRule":{"type":"object","properties":{"pattern":{"type":"string","description":"`plugin/operation`, `plugin/*`, or `*`."},"decision":{"type":"string","enum":["auto","manual"],"description":"auto: run immediately. manual: needs customer approval before running."},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself."}},"required":["pattern","decision"]},"UpdateOperationsPolicyRequest":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"},"description":"The full rule set (replaces the previous one)."}},"required":["rules"]},"InvokeOperationResponse":{"type":"object","properties":{"plugin":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"The operation's declared risk tier (informational)."},"decision":{"type":"string","enum":["auto","manual"],"description":"The approval decision the policy resolved to."},"status":{"type":"string","enum":["dispatched","pending-approval"],"description":"dispatched: auto-approved and running. pending-approval: needs customer sign-off."},"commandId":{"type":"string","description":"The created operation-command id when dispatched (absent when pending)."}},"required":["plugin","operation","tier","decision","status"]},"InvokeOperationRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment to run the operation against."},"plugin":{"type":"string","description":"Plugin name."},"operation":{"type":"string","description":"Operation name exposed by the plugin."},"params":{"nullable":true,"description":"JSON params passed to the operation."},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key used to deduplicate this exact target operation."},"remediationPlanId":{"type":"string","description":"A remediation plan (`plan_…`) whose access request the customer has already approved for this exact command. When set and the plan's access request was created by the caller, is `customer-approved` and lists this `plugin/operation` with these params, the invocation is authorized by that approval and dispatches immediately regardless of the project's operations policy — the customer already signed off on this exact command via the access-request flow, so the project's default `manual` policy (meant for ad-hoc, unreviewed invocations) would otherwise require a second, redundant approval for the same action. Another principal's approved request never authorizes the caller."},"accessRequestId":{"type":"string","description":"A CLI-originated access request (`accessRequest_…`, no remediation plan) the caller created and the customer has already approved covering this exact command — either an exact match or a resolved, frozen wildcard entry. Same bypass semantics as `remediationPlanId`, for requests with no investigation behind them. Set exactly one of `remediationPlanId` or `accessRequestId`, not both. With neither, any approved request the caller created covering this exact command is used."}},"required":["deploymentId","plugin","operation"]},"VerifyOperationCheckResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["verified","not-yet","failed","skipped"],"description":"verified: success condition met. not-yet: keep polling. failed: the poll operation itself reported failure. skipped: the operation has no verification spec, or the write result carries none of the fields verification needs (the caller never opted in for this invocation)."},"reason":{"type":"string","description":"Present for 'failed' and 'skipped'."},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer"},"intervalSeconds":{"type":"integer"}},"required":["maxAttempts","intervalSeconds"],"description":"The operation's declared retry policy, echoed so the caller's poll loop doesn't need its own copy."},"timeoutSeconds":{"type":"integer","description":"The operation's declared verification timeout."}},"required":["outcome"]},"VerifyOperationCheckRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment the original write command ran against."},"commandId":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Original operation command whose stored result and dispatch-time verification contract are authoritative.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"}},"required":["deploymentId","commandId"]},"AccessRequestDebugGrant":{"type":"object","nullable":true,"properties":{"tool":{"$ref":"#/components/schemas/DebugGrantTool"},"namespace":{"type":"string","example":"braintrust"},"cloudScope":{"type":"string","example":"123456789012/prod-readonly"}},"required":["tool"]},"DebugGrantTool":{"type":"string","enum":["kubectl","aws","gcloud","az"]},"AccessRequestStatus":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"CreateAccessRequest":{"type":"object","properties":{"replayKey":{"type":"string","minLength":1,"maxLength":128,"description":"Durable replay key scoped to the authenticated requester and workspace. Reusing it with a different validated payload returns ACCESS_REQUEST_REPLAY_MISMATCH."},"requestedExpiresAt":{"type":"string","format":"date-time","description":"Absolute requester deadline in UTC (Z suffix). Must be in the future and at most six hours ahead (30 seconds clock-skew tolerance). Approvals never extend it. Omit for legacy approval-window behavior."},"deploymentId":{"type":"string"},"remediationPlanId":{"type":"string","description":"Set for a plan-backed (ai-agent) request. Omit for a plan-less (CLI) request."},"title":{"type":"string","description":"Required for a plan-backed request; defaults to the operation/pattern/debug-tool for a plan-less one."},"reason":{"type":"string"},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]},"minItems":1,"description":"Plan-backed only: the exact commands the investigation is requesting."},"operation":{"type":"string","example":"kubernetes/restart-pod","description":"Plan-less, exact request: a single `plugin/operation`."},"operationPattern":{"type":"string","example":"kubernetes/*","description":"Plan-less, wildcard request: `plugin/*`. Requires `maxRisk`."},"params":{"nullable":true,"description":"Params for an exact `operation` request."},"maxRisk":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Required with `operationPattern`: the highest risk tier the wildcard grant may cover."},"debugTool":{"allOf":[{"$ref":"#/components/schemas/DebugGrantTool"},{"description":"Requests a remote-debugging grant for this tool, alongside or instead of an operations grant."}]},"debugNamespace":{"type":"string","example":"braintrust","description":"Scopes a `kubectl` debug grant to one Kubernetes namespace. Requires `debugTool: kubectl`."},"debugCloudScope":{"type":"string","example":"123456789012/prod-readonly","description":"Scopes an `aws`/`gcloud`/`az` debug grant to a customer-meaningful account/project/subscription string. Requires `debugTool` set to that provider."}},"required":["deploymentId"]},"AccessRequestApprovalMethod":{"type":"string","example":"slack"},"AccessRequestActivity":{"type":"object","properties":{"operations":{"type":"array","items":{"type":"object","properties":{"commandId":{"type":"string"},"invocationId":{"type":"string","nullable":true,"description":"The MCP invocation that dispatched the command, when MCP did."},"command":{"type":"string","description":"`plugin/operation`."},"state":{"type":"string"},"createdAt":{"type":"string"},"dispatchedAt":{"type":"string","nullable":true},"completedAt":{"type":"string","nullable":true},"verification":{"$ref":"#/components/schemas/CommandVerification"}},"required":["commandId","invocationId","command","state","createdAt","dispatchedAt","completedAt","verification"]}},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"state":{"$ref":"#/components/schemas/DebugSessionState"},"owner":{"type":"string","nullable":true},"createdAt":{"type":"string"},"expiresAt":{"type":"string"}},"required":["id","state","owner","createdAt","expiresAt"]}}},"required":["operations","debugSessions"]},"RevokeAccessRequest":{"type":"object","properties":{"reason":{"type":"string","maxLength":4096,"description":"Why the grant is withdrawn, for the audit trail."}}},"SyncListResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"userEnvironmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"deploymentToken":{"type":"string","nullable":true},"lockedBy":{"type":"string","nullable":true},"lockedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId","userEnvironmentVariables"]}}},"required":["deployments"],"description":"Full deployment records for manager operation"},"SyncListRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. Manager-scoped tokens are always constrained to their own manager ID."}]},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to include"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment status"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by deployment platform"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Filter by deployment group ID","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"limit":{"type":"integer","minimum":1,"maximum":500,"description":"Maximum records to return"}},"additionalProperties":false,"description":"Request to list full operational deployments"},"SyncAcquireResponseDeployment":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Deployment group ID the deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method recorded on the deployment when it has a setup-owned path."}]},"operationId":{"type":"string","nullable":true,"pattern":"duop_[0-9a-z]{28}$","description":"Immutable target claimed for this execution, or null for observation-only work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","nullable":true,"pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed by this manager session, or null for observation-only work.","example":"duat_uve04tou5eoua3q17dar1pz"},"current":{"$ref":"#/components/schemas/DeploymentState"},"config":{"$ref":"#/components/schemas/DeploymentConfig"}},"required":["deploymentId","projectId","deploymentGroupId","operationId","attemptId","current","config"]},"DeploymentState":{"type":"object","properties":{"currentRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}]},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"protocolVersion":{"type":"integer","minimum":0,"description":"Protocol version for cross-actor compatibility.\nAll actors (manager, push client, agent) check this before stepping.\nMismatched versions produce a clear error instead of silent corruption.\nSee docs/02-manager/10-deployment-protocol.md."},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment\nWhen true and status is a failed state, the deployment system will retry failed resources"},"runtimeMetadata":{"oneOf":[{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},{"nullable":true}]},"stackState":{"oneOf":[{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},{"nullable":true}]},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"targetRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]}},"required":["platform","protocolVersion","status"],"description":"Current deployment state (includes releases)"},"DeploymentConfig":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["environmentVariables"],"description":"Deployment configuration"},"SyncContextRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the context. Manager-scoped tokens are constrained to their own manager ID."}]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false},"SyncAcquireResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"},"description":"List of acquired deployments with deployment context"},"failures":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment that failed","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"error":{"allOf":[{"$ref":"#/components/schemas/APIError"},{"description":"Error that occurred during context building"}]}},"required":["deploymentId","projectId","error"]},"description":"List of deployments that failed during context building (locks already released)"},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time","description":"When the provisional leases on the returned deployments lapse. Confirm them with sync/renew before starting work. Null when nothing was acquired."}},"required":["deployments","failures","leaseExpiresAt"],"description":"Acquired deployments and failures"},"SyncAcquireRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. If omitted, resolved from each deployment's managerId column."}]},"session":{"type":"string","description":"Unique session identifier for lock tracking"},"requestId":{"type":"string","minLength":1,"description":"Idempotency key for one logical acquire request"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to lock (for Pull model sync)"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment statuses (default: all deployment statuses)"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by platforms (default: all platforms the Manager supports)"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Filter by setup method for setup-owned acquisition paths"}]},"acquireMode":{"type":"string","enum":["runtime","setup-run","setup-teardown"],"description":"Phase ownership mode for deployment acquisition"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model from stackSettings.deploymentModel."},"supportsExecutionClaims":{"type":"boolean","enum":[true],"description":"Signals support for echoing executionClaim on renew, reconcile, and release."},"limit":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of deployments to acquire (default: 10)"}},"required":["session","requestId","deploymentModel"],"additionalProperties":false,"description":"Request to acquire deployments for processing"},"SyncReconcileResponse":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the state was reconciled"},"current":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Current deployment state after reconciliation"}]},"target":{"$ref":"#/components/schemas/TargetDeployment"},"targetOperationsBundleSet":{"$ref":"#/components/schemas/TargetOperationsBundleSet"},"targetDynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"deleted":{"type":"boolean"},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]},"suspendedReason":{"type":"string","maxLength":512}},"required":["name","generation","image","cpu","memory","replicas","ports","deleted","env","secretEnv"]},"description":"Complete release-independent dynamic container target set for a Kubernetes Operator."}},"required":["success","current"],"description":"State reconciliation result with optional target"},"TargetDeployment":{"type":"object","properties":{"config":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["environmentVariables"],"description":"Deployment configuration\n\nConfiguration for how to perform the deployment.\nNote: Credentials (ClientConfig) are passed separately to step() function."},"releaseInfo":{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."}},"required":["config","releaseInfo"],"description":"Target deployment if update is needed"},"TargetOperationsBundleSet":{"type":"object","properties":{"hash":{"type":"string","minLength":1,"maxLength":256},"bundles":{"type":"array","items":{"$ref":"#/components/schemas/OperationsBundleDownload"}}},"required":["hash","bundles"],"description":"Target operations-bundle set the Operator should converge its loaded plugin registry toward."},"OperationsBundleDownload":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"url":{"type":"string","format":"uri","description":"Presigned URL to GET the bundle ZIP from. Short-lived."}},"required":["plugin","pluginVersion","url"]},"SyncReconcileRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to reconcile state for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Lock session (push model only) - verifies lock ownership"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Immutable operation claimed at acquisition. Required with attemptId for update execution.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed at acquisition. Required with operationId for update execution.","example":"duat_uve04tou5eoua3q17dar1pz"},"state":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Complete deployment state after step() execution"}]},"updateHeartbeat":{"type":"boolean","description":"Update heartbeat timestamp (for successful health checks)"},"suggestedDelayMs":{"type":"integer","minimum":0,"description":"Delay before this deployment should be acquired again."},"resourceHeartbeats":{"type":"array","items":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"description":"Latest typed resource heartbeats collected during this step."},"observedInventoryBatches":{"type":"array","items":{"$ref":"#/components/schemas/ObservedInventoryBatch"},"description":"Observed raw-resource inventory batches read during this step."},"capabilities":{"type":"array","items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Operator-reported runtime capabilities."},"operatorVersion":{"type":"string","minLength":1,"maxLength":128,"description":"Operator binary version reported by the runtime."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorImageIdentity"},"operationsReport":{"$ref":"#/components/schemas/OperationsReport"},"dynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"message":{"type":"string","maxLength":2048}},"required":["name","generation","status"]},"description":"Observed dynamic container generations from a Kubernetes Operator."}},"required":["deploymentId","state"],"additionalProperties":false,"description":"Request to reconcile deployment state"},"ObservedInventoryBatch":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"],"description":"Backend whose observer produced this snapshot."},"complete":{"type":"boolean","description":"Whether this batch is a complete replacement for the scope. Complete\nbatches tombstone previously observed rows in the same scope when they\nare absent from `resources`."},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inventoryScope":{"type":"string","description":"Stable scope for the provider list operation that produced this batch."},"observedAt":{"type":"string","format":"date-time","description":"Time the inventory scope was observed."},"resources":{"type":"array","items":{"type":"object","properties":{"alienResourceId":{"type":"string","nullable":true},"attributes":{"type":"object","properties":{},"additionalProperties":{"nullable":true}},"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"counts":{"oneOf":[{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},{"nullable":true}]},"deploymentId":{"type":"string","nullable":true},"displayName":{"type":"string"},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"images":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."},"description":"Distinct container images the resource's running instances report, when\nthe provider exposes them."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerKind":{"type":"string","description":"Provider-native kind, such as `apps/v1/Deployment`,\n`AWS::S3::Bucket`, `storage.googleapis.com/Bucket`, or an Azure\nresource type."},"providerStale":{"type":"boolean"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"rawIdentity":{"type":"string","description":"Provider-native stable identity: Kubernetes object identity, cloud ARN,\nGCP full resource name, Azure resource id, etc."},"region":{"type":"string","nullable":true},"resourceTypeHint":{"oneOf":[{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},{"nullable":true}]},"scope":{"type":"string","nullable":true},"version":{"type":"string","nullable":true,"description":"Release/version identity observed from the provider resource, when available."}},"required":["displayName","health","lifecycle","partial","providerKind","providerStale","rawIdentity"]}},"sourceKind":{"type":"string","description":"Writer/source for this inventory pass, such as `operator` or\n`manager-observer`."}},"required":["backend","complete","controllerPlatform","inventoryScope","observedAt","resources","sourceKind"]},"RemoteOperatorImageIdentity":{"type":"object","properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"}},"required":["source","packageId","packageVersion","image","digest"],"additionalProperties":false,"description":"Immutable installer receipt self-reported by a running Remote Operator. This is not independent runtime image inspection."},"OperationsReport":{"type":"object","properties":{"loadedBundleHash":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"operations":{"type":"array","items":{"$ref":"#/components/schemas/ReportedOperation"},"default":[]}},"description":"Operations bundle set the Operator currently has loaded, for plugin-sync status tracking."},"SyncRenewRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Single deployment to renew. Deprecated: use deploymentIds. Retained so a manager built against the previous API keeps renewing during rollout.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"minItems":1,"maxItems":100,"description":"Deployments to renew or confirm. Renewal is per deployment: the response reports each one independently."},"claims":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Unique identifier for the deployment update attempt.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","operationId","attemptId"]},"maxItems":100,"description":"Claim identities for deployments currently executing an update."},"session":{"type":"string","minLength":1}},"required":["session"],"additionalProperties":false},"SyncReleaseRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to release","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Session identifier to release"},"mode":{"type":"string","enum":["release","acknowledge-completed"],"description":"Defaults to release. acknowledge-completed discards an exact terminal pull receipt after a lost response; it never releases newer work or grants a live lease."},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Operation returned by acquire. Required when the lease carried update work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Attempt returned by acquire. Required when the lease carried update work.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","session"],"additionalProperties":false,"description":"Request to release deployment lock"},"ResolveResponse":{"type":"object","properties":{"managerId":{"type":"string","description":"Manager ID"},"managerName":{"type":"string","description":"Manager display name"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL"},"managerIsSystem":{"type":"boolean","description":"Whether the manager is Alien-hosted"},"managerCloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where the private manager is hosted. Null for Alien-hosted managers."},"projectId":{"type":"string","description":"Resolved project ID"},"installContext":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}},"required":["platform","managementConfig"],"description":"Target install context derived from platform-managed manager metadata. Present for cloud push platforms."}},"required":["managerId","managerName","managerUrl","managerIsSystem","projectId"]},"CloudRegionsResponse":{"type":"object","properties":{"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"}},"required":["supportedRegions"]},"BillingAuditLogRow":{"type":"object","properties":{"id":{"type":"string"},"workspaceId":{"type":"string","nullable":true},"action":{"type":"string"},"payload":{"nullable":true},"createdAt":{"type":"string"}},"required":["id","workspaceId","action","createdAt"]},"WorkspaceBillingEntitlements":{"type":"object","properties":{"planId":{"$ref":"#/components/schemas/PlanId"},"planStatus":{"$ref":"#/components/schemas/BillingPlanStatus"},"features":{"$ref":"#/components/schemas/BillingFeatureFlags"},"limits":{"$ref":"#/components/schemas/BillingLimits"},"syncedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"}},"required":["planId","planStatus","features","limits","syncedAt","stale"]},"PlanId":{"type":"string","enum":["starter","pro","pro_annual","enterprise"]},"BillingPlanStatus":{"type":"string","enum":["active","trialing","past_due","canceled","none"]},"BillingFeatureFlags":{"type":"object","properties":{"custom_domains":{"type":"boolean"},"private_managers":{"type":"boolean"},"operations_custom_plugins":{"type":"boolean"},"sso_saml":{"type":"boolean"},"audit_logs":{"type":"boolean"},"airgapped":{"type":"boolean"}},"required":["custom_domains","private_managers","operations_custom_plugins","sso_saml","audit_logs","airgapped"]},"BillingLimits":{"type":"object","properties":{"maxDeployments":{"type":"number","nullable":true},"maxProjects":{"type":"number","nullable":true},"maxSeats":{"type":"number","nullable":true},"maxCustomDomains":{"type":"number","nullable":true},"creditUsd":{"type":"number","nullable":true},"seatsIncluded":{"type":"number","nullable":true}},"required":["maxDeployments","maxProjects","maxSeats","maxCustomDomains","creditUsd","seatsIncluded"]},"WorkspaceGatewayOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"summary":{"type":"object","properties":{"totalProjects":{"type":"integer","minimum":0},"gatewayProjects":{"type":"integer","minimum":0},"activeProjects":{"type":"integer","minimum":0},"setupInProgressProjects":{"type":"integer","minimum":0},"needsAttentionProjects":{"type":"integer","minimum":0},"connectedCustomers":{"type":"integer","minimum":0}},"required":["totalProjects","gatewayProjects","activeProjects","setupInProgressProjects","needsAttentionProjects","connectedCustomers"]},"projects":{"type":"array","items":{"$ref":"#/components/schemas/GatewayProjectOverview"}}},"required":["generatedAt","summary","projects"]},"GatewayProjectOverview":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"state":{"$ref":"#/components/schemas/GatewayProjectState"},"connectedCustomers":{"type":"integer","minimum":0},"settingUpCustomers":{"type":"integer","minimum":0},"needsAttentionCustomers":{"type":"integer","minimum":0},"revokedCustomers":{"type":"integer","minimum":0}},"required":["id","name","state","connectedCustomers","settingUpCustomers","needsAttentionCustomers","revokedCustomers"]},"GatewayProjectState":{"type":"string","enum":["not-set-up","setup-in-progress","active","needs-attention"]},"GatewayKind":{"type":"string","enum":["ai","encryption","sandbox"],"description":"Alien Gateway a customer deployment runs","example":"ai"}},"parameters":{}},"paths":{"/v1/invitations/{token}":{"get":{"operationId":"getWorkspaceInvitationPreview","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation preview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitationPreview"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/memberships":{"get":{"operationId":"listMemberships","description":"List all workspaces the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listMemberships","responses":{"200":{"description":"List of user's workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Membership"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile":{"get":{"operationId":"getUserProfile","description":"Get the current user's profile and user-scoped onboarding state.","x-speakeasy-group":"user","x-speakeasy-name-override":"getProfile","responses":{"200":{"description":"User profile.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateUserProfile","description":"Update the current user's profile (display name).","x-speakeasy-group":"user","x-speakeasy-name-override":"updateProfile","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"}}}}}},"responses":{"200":{"description":"Profile updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile/setup":{"post":{"operationId":"completeUserProfileSetup","description":"Complete the required beta intake and profile setup dialog.","x-speakeasy-group":"user","x-speakeasy-name-override":"completeProfileSetup","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfileSetupRequest"}}}},"responses":{"200":{"description":"Profile setup completed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/workspaces":{"post":{"operationId":"createWorkspace","description":"Create a new workspace. The current user will be automatically added as an admin.","x-speakeasy-group":"user","x-speakeasy-name-override":"createWorkspace","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name"},"logoUrl":{"type":"string","format":"uri","description":"Optional workspace logo URL"}},"required":["name"]}}}},"responses":{"201":{"description":"Created workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Membership"}}}},"400":{"description":"Bad request - invalid workspace name.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Workspace name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces":{"get":{"operationId":"listGitNamespaces","description":"List all git namespaces (GitHub installations) the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaces","parameters":[{"schema":{"type":"string","enum":["github"],"default":"github"},"required":false,"name":"provider","in":"query"}],"responses":{"200":{"description":"List of user's git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/sync":{"post":{"operationId":"syncGitNamespaces","description":"Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.","x-speakeasy-group":"user","x-speakeasy-name-override":"syncGitNamespaces","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github"],"description":"Git provider to sync"}},"required":["provider"]}}}},"responses":{"200":{"description":"Synced git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/{id}/repositories":{"get":{"operationId":"listGitNamespaceRepositories","description":"List repositories accessible through a git namespace (GitHub installation).","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaceRepositories","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","description":"Search query to filter repositories by name"},"required":false,"description":"Search query to filter repositories by name","name":"search","in":"query"}],"responses":{"200":{"description":"List of repositories.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitRepository"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Git namespace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/pending":{"get":{"operationId":"getPendingWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"required":true,"name":"workspace","in":"query"}],"responses":{"200":{"description":"An active invitation addressed to the signed-in user for this workspace, if any.","content":{"application/json":{"schema":{"type":"object","properties":{"invitationId":{"type":"string","nullable":true,"pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"}},"required":["invitationId"]}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/{token}/accept":{"post":{"operationId":"acceptWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptWorkspaceInvitationResponse"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/whoami":{"get":{"operationId":"whoami","description":"Get the current authenticated principal (user or service account). Works with both session cookies and API keys.","x-speakeasy-group":"auth","x-speakeasy-name-override":"whoami","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","example":"my-workspace"},"required":false,"description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current authenticated principal.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Subject"}}}},"400":{"description":"Missing required workspace for user credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export":{"get":{"operationId":"getProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Configuration and delivery status; headers are never returned.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string","maxLength":2048,"format":"uri"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}}},"required":["endpoint","enabled"]}}}},"responses":{"200":{"description":"Saved configuration. Changes take effect within 30 seconds.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export/test":{"post":{"operationId":"testProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Result of sending one test log to the saved destination.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}":{"get":{"operationId":"getLogExportDeliveryConfig","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"responses":{"200":{"description":"Private runtime configuration for the assigned manager.","content":{"application/json":{"schema":{"type":"object","nullable":true,"properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}},"revision":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}},"required":["endpoint","enabled","headers","revision","updatedAt"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}/status":{"post":{"operationId":"reportLogExportDelivery","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"revision":{"type":"string"},"succeeded":{"type":"boolean"},"error":{"type":"string","nullable":true,"enum":["timeout","connection","destination-rejected","invalid-destination","overflow",null]},"statusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599}},"required":["revision","succeeded","error"]}}}},"responses":{"200":{"description":"Delivery status recorded for the current configuration revision.","content":{"application/json":{"schema":{"type":"object","properties":{"accepted":{"type":"boolean"}},"required":["accepted"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces":{"get":{"operationId":"listWorkspaces","description":"Retrieve all workspaces.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search workspaces by name"},"required":false,"description":"Search workspaces by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Workspace"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}":{"get":{"operationId":"getWorkspace","description":"Retrieve a workspace by ID.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspace","description":"Update a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"}}}}}},"responses":{"200":{"description":"Workspace updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteWorkspace","description":"Delete a workspace. The workspace must have no projects.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Workspace deleted successfully."},"400":{"description":"Workspace still has projects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members":{"get":{"operationId":"listWorkspaceMembers","description":"List all members of a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"listMembers","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"List of workspace members.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceMember"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"addWorkspaceMember","description":"Add a member to a workspace by email. The user must already have an account.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"addMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email","description":"Email of the user to add"},"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"Role to assign"}]}},"required":["email","role"]}}}},"responses":{"201":{"description":"Member added successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"404":{"description":"Workspace or user not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"User is already a member.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members/{userId}":{"patch":{"operationId":"updateWorkspaceMember","description":"Update a workspace member's role.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"New role to assign"}]}},"required":["role"]}}}},"responses":{"200":{"description":"Member role updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"400":{"description":"Cannot remove last admin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"removeWorkspaceMember","description":"Remove a member from a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"removeMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Member removed successfully."},"400":{"description":"Cannot remove last admin or self.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/settings":{"get":{"operationId":"getWorkspaceSettings","description":"Read the ai-agent settings for a workspace. Returns defaults (`enabled: true`) when the workspace has never customized them.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"getSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspaceSettings","description":"Update the ai-agent settings for a workspace. Supports `enabled` (`false` turns the ai-agent off so incoming triggers are rejected before any session runs).","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkspaceSettingsRequest"}}}},"responses":{"200":{"description":"Updated ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations":{"get":{"operationId":"listWorkspaceInvitations","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Pending invitations.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceInvitation"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["email","role"]}}}},"responses":{"201":{"description":"Invitation created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"403":{"description":"Seat limit reached.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}/resend":{"post":{"operationId":"resendWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Invitation email sent again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}":{"delete":{"operationId":"revokeWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invitation revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invite-link":{"get":{"operationId":"getWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Active invite link.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"createWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["role"]}}}},"responses":{"200":{"description":"Invite link created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invite link revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects":{"get":{"operationId":"listProjects","description":"Retrieve all projects.","x-speakeasy-group":"projects","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search projects by name"},"required":false,"description":"Search projects by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deploymentCount","latestRelease"]},"description":"Optional fields to include: deploymentCount, latestRelease"},"required":false,"description":"Optional fields to include: deploymentCount, latestRelease","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved projects.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createProject","description":"Create a new project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"enabledCapabilities":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"minItems":1,"maxItems":5}},"required":["name"]}}}},"responses":{"201":{"description":"Project created successfully.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"}}}]}}}},"400":{"description":"Invalid request or GitHub repository connection failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}":{"get":{"operationId":"getProject","description":"Retrieve a project by ID or name.","x-speakeasy-group":"projects","x-speakeasy-name-override":"get","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateProject","description":"Update a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"update","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProject"}}}},"responses":{"200":{"description":"Project updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"403":{"description":"Project update permission is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this project's release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request or package settings are invalid or incomplete.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteProject","description":"Delete a project. The project must have no deployments.","x-speakeasy-group":"projects","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Project deleted successfully."},"400":{"description":"Project still has deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/gcp-oauth-provider":{"get":{"operationId":"getProjectGcpOAuthProvider","description":"Retrieve redacted project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectGcpOAuthProvider","description":"Update project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"updateGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProjectGcpOAuthProvider"}}}},"responses":{"200":{"description":"Google Cloud OAuth provider settings updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"400":{"description":"Invalid provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/source":{"post":{"operationId":"configureProjectSource","description":"Connect a GitHub repository or Alien template to an existing project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureSource","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["repository"]},"gitRepository":{"type":"object","properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","gitRepository"]},{"type":"object","properties":{"mode":{"type":"string","enum":["template"]},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","targetNamespace","templatePath"]}]}}}},"responses":{"200":{"description":"Project source connected.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}}}]}}}},"400":{"description":"Repository or template configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Template fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-portal-domain":{"get":{"operationId":"getProjectDeploymentPortalDomain","description":"Get the deployment portal domain binding for a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentPortalDomain","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment portal domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentPortalDomainResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/import-template":{"post":{"operationId":"createProjectFromTemplate","description":"Create a project by forking alienplatform/alien into your namespace.","x-speakeasy-group":"projects","x-speakeasy-name-override":"createFromTemplate","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$","description":"GitHub owner namespace (user or organization) that will receive the fork"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"}},"required":["name","targetNamespace","templatePath"]}}}},"responses":{"201":{"description":"Project created successfully from template.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}},"required":["template"]}]}}}},"400":{"description":"Bad request or GitHub integration not installed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/template-urls":{"get":{"operationId":"getProjectTemplateUrls","description":"Get template URLs for deploying setup stacks in this project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getTemplateUrls","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Template URLs retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"aws":{"type":"object","nullable":true,"properties":{"templateUrl":{"type":"string","format":"uri","description":"URL to download the CloudFormation template"},"launchStackUrl":{"type":"string","format":"uri","description":"URL to launch the template in the AWS CloudFormation console"}},"required":["templateUrl","launchStackUrl"],"description":"Template URLs for deploying an AWS setup stack"}}}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-link-setup":{"get":{"operationId":"getProjectDeploymentLinkSetup","description":"Get the active release stack and portal-visible setup availability for deployment-link configuration.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentLinkSetup","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment-link setup retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentLinkSetupResponse"}}}},"400":{"description":"The project's sandbox follows an Alien default image this environment does not configure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or active release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/active-release":{"get":{"operationId":"getProjectActiveRelease","description":"Get the production channel's current release. When deploymentId is provided, returns that deployment's effective release: its pin, or its followed channel's current release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getActiveRelease","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Optional deployment ID to check for pinned release"},"required":false,"description":"Optional deployment ID to check for pinned release","name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Effective release retrieved successfully.","content":{"application/json":{"schema":{"nullable":true}}}},"404":{"description":"Project or effective release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models/impact":{"post":{"operationId":"previewProjectModelsImpact","description":"Preview which customer model connections a configuration change may affect.","x-speakeasy-group":"projects","x-speakeasy-name-override":"previewModelsImpact","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Model configuration impact.","content":{"application/json":{"schema":{"type":"object","properties":{"connectedCustomers":{"type":"integer","minimum":0},"affectedCustomers":{"type":"integer","minimum":0},"verificationNeeded":{"type":"integer","minimum":0},"affected":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"provider":{"type":"string"},"reason":{"type":"string","enum":["provider-no-longer-compatible","required-model-not-in-catalog"]}},"required":["deploymentGroupId","name","externalId","provider","reason"]}},"truncated":{"type":"boolean"}},"required":["connectedCustomers","affectedCustomers","verificationNeeded","affected","truncated"]}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities":{"put":{"operationId":"setProjectCapabilities","description":"Set the capabilities offered by a Project. Removing a capability prevents new setup without deleting existing customer resources.","x-speakeasy-group":"projects","x-speakeasy-name-override":"setCapabilities","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"maxItems":5}},"required":["enabled"],"additionalProperties":false}}}},"responses":{"200":{"description":"The Project's enabled capabilities.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/deployments":{"put":{"operationId":"configureProjectDeployments","description":"Enable deployments for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureDeployments","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled","methods"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployments enabled for the Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-provider-headers":{"get":{"operationId":"getProjectAiProviderHeaders","description":"Get static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Static AI provider headers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"configureProjectAiProviderHeaders","description":"Replace the static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"responses":{"200":{"description":"Static AI provider headers updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"400":{"description":"Provider header configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models":{"put":{"operationId":"configureProjectModels","description":"Configure customer-owned model providers without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureModels","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Customer Models configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/keys":{"put":{"operationId":"configureProjectKeys","description":"Enable customer-owned application encryption without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["applicationEncryption"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Key configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/buckets":{"put":{"operationId":"configureProjectBuckets","description":"Enable buckets without requiring a project Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureBuckets","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"access":{"type":"string","enum":["read-write"]}},"required":["access"],"additionalProperties":false}}}},"responses":{"200":{"description":"Buckets configured and their exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/registry":{"put":{"operationId":"configureProjectRegistry","description":"Enable customer-owned container registries without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRegistry","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["repositories","credentialPolicy"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Registry configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox":{"put":{"operationId":"configureProjectRemoteSandbox","description":"Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRemoteSandbox","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureRemoteSandboxRequest"}}}},"responses":{"200":{"description":"Sandbox configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"400":{"description":"The sandbox configuration cannot be satisfied by this environment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The request body is invalid, including a per-cloud field.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The image's registry or Alien's GCP image service could not be reached, or the save's GCP image could not be queued; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox/base-image-repository":{"post":{"operationId":"ensureProjectSandboxBaseImageRepository","description":"Ensure the project's private image repository exists and return where to push a private sandbox base image. Name the pushed image as the remote sandbox base image afterwards.","x-speakeasy-group":"projects","x-speakeasy-name-override":"ensureSandboxBaseImageRepository","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Repository ready to receive a push.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SandboxBaseImageRepository"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found, or no AWS manager serves it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager could not prepare the repository.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The project's manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/overview":{"get":{"operationId":"getProjectCapabilityOverview","description":"Get safe, server-derived capability status for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getCapabilityOverview","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Project capability overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilityOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-bindings/access":{"post":{"operationId":"createRemoteBindingsExternalAccess","tags":["remote-bindings"],"summary":"Create short-lived Remote Bindings access for a external resource","description":"Selects a connected external resource by Project and external ID, then returns a short-lived deployment-scoped Manager capability. The caller never receives the external cloud credentials from Platform.","x-speakeasy-group":"remoteBindings","x-speakeasy-name-override":"createExternalAccess","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessRequest"}}}},"responses":{"200":{"description":"Short-lived Remote Bindings access was created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessResponse"}}}},"401":{"description":"The API key is missing, invalid, expired, or disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot access Remote Bindings for this Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The Project or external ID was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"More than one active external resource matched.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The external resource or its assigned Manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary":{"get":{"operationId":"getRemoteOperatorProjectSummary","tags":["projects"],"summary":"Get the authoritative Remote Operator project summary","x-speakeasy-group":"projects","x-speakeasy-name-override":"getRemoteOperatorSummary","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Authoritative Remote Operator state composed from existing owners.","content":{"application/json":{"schema":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"nextAction":{"type":"object","properties":{"kind":{"type":"string","enum":["connect","inspect","reconnect","verify","update","wait","none"]},"target":{"type":"string","enum":["setup","deployment","releases","access","operations","activity"]},"deploymentId":{"type":"string","nullable":true},"message":{"type":"string"}},"required":["kind","target","deploymentId","message"]},"installations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroupId":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs","unknown"]},"region":{"type":"string","nullable":true},"state":{"type":"string","enum":["unhealthy","stale","connecting","unverified","verified"]},"stateReason":{"type":"string"},"status":{"type":"string"},"lastHeartbeatAt":{"type":"string","nullable":true,"format":"date-time"},"lastSuccessfulDiagnosticAt":{"type":"string","nullable":true,"format":"date-time"},"operatorVersion":{"type":"string","nullable":true},"operatorScope":{"type":"string","nullable":true},"operatorPermission":{"type":"string","nullable":true},"expectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"previousExpectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"runningImage":{"$ref":"#/components/schemas/ObservedRemoteOperatorImageIdentity"},"imageStatus":{"type":"string","enum":["matching","drifted","unreported","unconfigured"]},"operatorUpdate":{"type":"object","nullable":true,"properties":{"packageId":{"type":"string"},"packageVersion":{"type":"string"},"image":{"type":"string"},"digest":{"type":"string"},"builtAt":{"type":"string","format":"date-time"}},"required":["packageId","packageVersion","image","digest","builtAt"],"description":"The ready Operator image selected by the project's current configuration when it differs from the image this installation was set up with. Re-applying setup installs it. Null when the installation already uses it, its install identity is unknown, or the selected package is not ready."},"operationSync":{"type":"object","nullable":true,"properties":{"status":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"string","nullable":true}},"required":["status","targetBundleHash","observedBundleHash","targetSetAt","observedAt","error"]},"application":{"type":"object","properties":{"state":{"type":"string","enum":["no-desired","up-to-date","update-required","unknown","failed"],"description":"How the application release the Operator reports compares with the desired release. Alien never applies the change; the customer applies it through their own release process."},"reason":{"type":"string"},"reported":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The application release the Operator reports"},"desired":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["channel","pin"]},"helmChart":{"type":"object","nullable":true,"properties":{"chart":{"type":"string"},"version":{"type":"string"}},"required":["chart","version"],"description":"The Helm chart built for this release, when the release has one"},"images":{"type":"array","items":{"type":"string"},"description":"Container images the release records for AWS, in resource order"}},"required":["releaseId","version","source","helmChart","images"],"description":"The release the deployment should run: its pinned release or its channel's release"},"releaseChannel":{"type":"string","description":"The release channel the deployment follows when unpinned"},"rollback":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The release the deployment reported before it moved to the desired release"}},"required":["state","reason","reported","desired","releaseChannel","rollback"]},"permissions":{"type":"object","properties":{"status":{"type":"string","enum":["current","outdated","unknown"],"description":"Whether the Kubernetes RBAC and cloud IAM recorded for this installation match the permissions compiled from the currently enabled operations."},"recordedAt":{"type":"string","nullable":true,"format":"date-time","description":"When setup was issued or last re-applied; null when nothing was recorded."},"reason":{"type":"string"}},"required":["status","recordedAt","reason"],"description":"Installed cloud and Kubernetes permissions. Setup applies them, so enabling or disabling operations changes them only after the installation's setup is re-applied."}},"required":["id","name","deploymentGroupId","platform","region","state","stateReason","status","lastHeartbeatAt","lastSuccessfulDiagnosticAt","operatorVersion","operatorScope","operatorPermission","expectedImage","previousExpectedImage","runningImage","imageStatus","operatorUpdate","operationSync","application","permissions"]}},"unregisteredSetups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs"]},"createdAt":{"type":"string","format":"date-time"},"valuesExpireAt":{"type":"string","nullable":true,"format":"date-time","description":"When the newest installation values stop working. Resuming setup can replace them."}},"required":["deploymentGroupId","name","platform","createdAt","valuesExpireAt"]},"description":"Setups whose installation values were created but whose Operator never registered, newest first."}},"required":["items","unregisteredSetups"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"release":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"reported":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"deployments":{"type":"integer","minimum":0,"exclusiveMinimum":true},"latest":{"type":"boolean"}},"required":["releaseId","version","createdAt","deployments","latest"]},"description":"Application releases that Remote Operator deployments report, newest first. The newest reported release is latest."},"older":{"type":"integer","minimum":0,"description":"Deployments without a desired release that report a release older than the latest reported release"},"unknown":{"type":"integer","minimum":0,"description":"Deployments that report no application release"},"rollout":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"upToDate":{"type":"integer","minimum":0},"waiting":{"type":"integer","minimum":0},"unknown":{"type":"integer","minimum":0},"failed":{"type":"integer","minimum":0}},"required":["releaseId","version","upToDate","waiting","unknown","failed"]},"description":"Desired releases, most deployments first, with how many Remote Operator deployments run each one, still need the change, report no release, or failed after it"}},"required":["reported","older","unknown","rollout"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"access":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"pending":{"type":"integer","minimum":0},"active":{"type":"integer","minimum":0},"recent":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"approvedUntil":{"type":"string","nullable":true,"format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","title","status","approvedUntil","updatedAt"]}}},"required":["pending","active","recent"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"operations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"selected":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["builtin","custom"]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]}},"required":["name","tier"]}}},"required":["name","version","source","operations"]}},"sync":{"type":"object","properties":{"preparing":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"ready":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["preparing","syncing","ready","stuck"]},"generatedPermissions":{"type":"array","items":{"type":"object","properties":{"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]},"cloud":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetes":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["plugin","pluginVersion","operation","tier","cloud"]}}},"required":["selected","sync","generatedPermissions"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"activity":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"recent":{"type":"array","items":{"type":"object","properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string","nullable":true},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","nullable":true},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt"]}},"investigations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"deploymentId":{"type":"string"},"status":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","triggerType","deploymentId","status","createdAt","updatedAt"]},"description":"Recent agent sessions about Remote Operator deployments or their access requests"},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"state":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","state","createdAt","expiresAt"]}},"lastVerifiedOperation":{"type":"object","nullable":true,"properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string"},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","enum":["SUCCEEDED"]},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verification":{"type":"object","properties":{"state":{"type":"string","enum":["not-required","verified","skipped"]},"attempts":{"type":"integer","minimum":0},"maxAttempts":{"type":"integer","minimum":0},"deadline":{"type":"string","nullable":true,"format":"date-time"},"reason":{"type":"string","nullable":true}},"required":["state","attempts","maxAttempts","deadline","reason"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"resultAvailable":{"type":"boolean"},"result":{"nullable":true},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt","verification","sensitiveOutput","resultAvailable","completedAt"]}},"required":["recent","investigations","debugSessions","lastVerifiedOperation"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]}},"required":["generatedAt","project","nextAction","installations","release","access","operations","activity"]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-image":{"post":{"operationId":"acceptRemoteOperatorImage","tags":["projects"],"summary":"Accept a reported image for a Remote Operator installation","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorImage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"responses":{"200":{"description":"The observed immutable image is now the accepted desired image.","content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"400":{"description":"The deployment is not a Remote Operator installation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The requested image is not the image in the latest Operator heartbeat.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-permissions":{"post":{"operationId":"acceptRemoteOperatorPermissions","tags":["projects"],"summary":"Record that a Remote Operator installation's setup was re-applied","description":"Records the permissions compiled from the currently enabled operations as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorPermissions","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"reviewedPermissions":{"type":"array","items":{"$ref":"#/components/schemas/RemoteOperatorPermissionPlugin"},"description":"The enabled operations' permission declarations that the owner reviewed and re-applied."}},"required":["reviewedPermissions"]}}}},"responses":{"200":{"description":"The current permissions are recorded as installed.","content":{"application/json":{"schema":{"type":"object","properties":{"recordedAt":{"type":"string","format":"date-time"}},"required":["recordedAt"]}}}},"400":{"description":"The deployment is not a Kubernetes or ECS Remote Operator installation, or an enabled operation is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The enabled operations changed after the reviewed permissions were loaded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-metrics":{"get":{"operationId":"getProjectAiUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe AI Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"pricing":{"type":"object","properties":{"label":{"type":"string","enum":["Estimated provider cost"]},"coverage":{"type":"number","minimum":0,"maximum":1},"revision":{"type":"string","nullable":true}},"required":["label","coverage","revision"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","deploymentGroupId","name","externalId"]}},"models":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"publicModel":{"type":"string"},"provider":{"type":"string"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","publicModel","provider"]}},"customersTruncated":{"type":"boolean"},"modelsTruncated":{"type":"boolean"}},"required":["status","range","pricing","totals","timeSeries","customers","models","customersTruncated","modelsTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/encryption-metrics":{"get":{"operationId":"getProjectEncryptionUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getEncryptionUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Encryption Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","bucket"]}},"operations":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"operation":{"type":"string","enum":["encrypt","decrypt"]}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","operation"]}}},"required":["status","range","totals","timeSeries","operations"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/sandbox-metrics":{"get":{"operationId":"getProjectSandboxMetrics","x-speakeasy-group":"projects","x-speakeasy-name-override":"getSandboxMetrics","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Sandbox Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"externalId":{"type":"string","nullable":true},"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"lastSeenAt":{"type":"string","format":"date-time"}},"required":["deploymentGroupId","externalId","sessions","commands","lastSeenAt"]}},"customersTruncated":{"type":"boolean"}},"required":["status","range","totals","timeSeries","customers","customersTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups":{"post":{"operationId":"createDeploymentGroup","tags":["deployment-groups"],"summary":"Create a new deployment group","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group with this name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentGroups","tags":["deployment-groups"],"summary":"List deployment groups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of deployment groups","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"}}}]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-name":{"put":{"operationId":"ensureDeploymentGroupByName","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and name","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByNameRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-external-id":{"put":{"operationId":"ensureDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Optional for project-scoped API keys."},"required":false,"description":"Project ID or name. Optional for project-scoped API keys.","name":"project","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"required":true,"description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","name":"externalId","in":"query"}],"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project or deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/setup-links":{"post":{"operationId":"createSetupLink","tags":["setup-links"],"summary":"Create a customer setup link","description":"Ensures the Deployment Group identified by Project and external ID, then creates a group-scoped setup link with exact captured sources.","x-speakeasy-group":"setupLinks","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkRequest"}}}},"responses":{"200":{"description":"Customer environment ensured and setup link created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkResponse"}}}},"400":{"description":"Customer environment or setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Customer environment name or setup source conflicts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}":{"get":{"operationId":"getDeploymentGroup","tags":["deployment-groups"],"summary":"Get deployment group details","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"}],"responses":{"200":{"description":"Deployment group details","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"deploymentCount":{"type":"integer","description":"Current number of deployments in this deployment group"}},"required":["deploymentCount"]}]}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentGroup","tags":["deployment-groups"],"summary":"Update deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDeploymentGroup","tags":["deployment-groups"],"summary":"Delete deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Deployment group deleted successfully"},"400":{"description":"Cannot delete deployment group that has deployments","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/external-id":{"put":{"operationId":"setDeploymentGroupExternalId","tags":["deployment-groups"],"summary":"Set or clear a deployment group's external ID","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetDeploymentGroupExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group external ID updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group external ID already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/tokens":{"post":{"operationId":"createDeploymentGroupToken","tags":["deployment-groups"],"summary":"Create deployment group token","description":"Creates a deployment-group scoped API key and returns both the token and formatted deployment link","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenRequest"}}}},"responses":{"200":{"description":"Deployment group token created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"}}}},"400":{"description":"Deployment setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The project's sandbox configuration changed concurrently; retry the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/first-party-session":{"post":{"operationId":"createFirstPartyDeploymentSession","tags":["deployment-groups"],"summary":"Create first-party deployment session","description":"Mints a short-lived deployment-group token with the recommended self-deploy policy for the authenticated developer.","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"First-party deployment session created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateFirstPartyDeploymentSessionResponse"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external":{"get":{"operationId":"getExternalAIBinding","tags":["deployment-groups"],"summary":"Get external AI connection state","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"External AI connection state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBindingState"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putExternalAIBinding","tags":["deployment-groups"],"summary":"Connect or rotate an external AI provider key","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutExternalAIBindingRequest"}}}},"responses":{"202":{"description":"External AI connection stored and queued for checking","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBinding"}}}},"400":{"description":"The key is not valid for the selected provider","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The group already has an active cloud AI source","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Provider verification is temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteExternalAIBinding","tags":["deployment-groups"],"summary":"Revoke the external AI connection","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"External AI connection revoked"},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/models/{publicModelId}/checks":{"post":{"operationId":"createExternalAIModelCheck","tags":["deployment-groups"],"summary":"Queue an explicit external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":256},"required":true,"name":"publicModelId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"The potentially billable model check was queued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"400":{"description":"The model is not configured for this project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or binding not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/model-checks/{checkId}":{"get":{"operationId":"getExternalAIModelCheck","tags":["deployment-groups"],"summary":"Get an external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"checkId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Model check state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or check not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry":{"get":{"operationId":"getContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Container registry state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryState"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1,"maxLength":128}},"required":["deploymentId","resourceId"]}}}},"responses":{"200":{"description":"Registry route","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories":{"post":{"operationId":"createContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"}},"required":["name"]}}}},"responses":{"201":{"description":"Repository requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials":{"post":{"operationId":"createContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":64},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"minItems":1,"maxItems":100},"expiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["label","scope"]}}}},"responses":{"201":{"description":"Credential created; password is returned once","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateContainerRegistryCredentialResponse"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials/{credentialId}":{"delete":{"operationId":"revokeContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"required":true,"description":"Unique identifier for the container registry credential.","name":"credentialId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Credential revoked"},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories/{repositoryId}":{"delete":{"operationId":"deleteContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"required":true,"description":"Unique identifier for the container registry repository.","name":"repositoryId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"confirmName":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"disposition":{"type":"string","enum":["preserve","deleteContents"]}},"required":["confirmName","disposition"]}}}},"responses":{"202":{"description":"Repository deletion requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/verify":{"post":{"operationId":"verifyContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Verification requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/revoke":{"post":{"operationId":"revokeContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Registry revocation requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages":{"get":{"operationId":"listPackages","description":"List packages with optional filters. Returns packages ordered by creation date (newest first).","x-speakeasy-group":"packages","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Filter by package type"},"required":false,"description":"Filter by package type","name":"type","in":"query"},{"schema":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Filter by package status"},"required":false,"description":"Filter by package status","name":"status","in":"query"},{"schema":{"type":"string","pattern":"^rel_[0-9a-zA-Z]{28}$","description":"Filter by source release"},"required":false,"description":"Filter by source release","name":"sourceReleaseId","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search packages by type or version"},"required":false,"description":"Search packages by type or version","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of packages.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Package"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}":{"get":{"operationId":"getPackage","description":"Get details of a specific package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/rebuild":{"post":{"operationId":"rebuildPackages","description":"Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.","x-speakeasy-group":"packages","x-speakeasy-name-override":"rebuild","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to rebuild packages for"}},"required":["project"]}}}},"responses":{"200":{"description":"Packages rebuilt successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"packagesCreated":{"type":"integer","description":"Number of packages created"}},"required":["packagesCreated"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle the release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}/cancel":{"post":{"operationId":"cancelPackage","description":"Cancel a pending or building package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"cancel","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package canceled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"400":{"description":"Package cannot be canceled (not in pending or building status).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases":{"get":{"operationId":"listReleases","description":"Retrieve all releases.","x-speakeasy-group":"releases","x-speakeasy-name-override":"list","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","description":"Filter to releases promoted to this channel. Defaults to production."},"required":false,"description":"Filter to releases promoted to this channel. Defaults to production.","name":"channel","in":"query"},{"schema":{"type":"string","enum":["true","false"],"default":"false"},"required":false,"name":"allChannels","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search releases by commit message, branch, SHA, or release ID"},"required":false,"description":"Search releases by commit message, branch, SHA, or release ID","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by git branch (commitRef)"},"required":false,"description":"Filter by git branch (commitRef)","name":"branch","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by commit author login or name"},"required":false,"description":"Filter by commit author login or name","name":"author","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created after this date (ISO 8601)"},"required":false,"description":"Filter releases created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created before this date (ISO 8601)"},"required":false,"description":"Filter releases created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved releases.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createRelease","description":"Create a new release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateReleaseRequest"}}}},"responses":{"201":{"description":"Release created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Release"}}}},"400":{"description":"Invalid release request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/branches":{"get":{"operationId":"listReleaseBranches","description":"List distinct git branches across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listBranches","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search branches by name (case-insensitive contains)"},"required":false,"description":"Search branches by name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of branches to return"},"required":false,"description":"Maximum number of branches to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct branches.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/authors":{"get":{"operationId":"listReleaseAuthors","description":"List distinct commit authors across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listAuthors","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search authors by login or name (case-insensitive contains)"},"required":false,"description":"Search authors by login or name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of authors to return"},"required":false,"description":"Maximum number of authors to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct authors.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseAuthorFilterItem"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}":{"get":{"operationId":"getRelease","description":"Retrieve a release by ID.","x-speakeasy-group":"releases","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseListItemResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}/deployments":{"get":{"operationId":"listReleaseDeployments","description":"List the project's deployments with their rollout state relative to this release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseRolloutState"},"description":"Filter deployments by rollout state"},"required":false,"description":"Filter deployments by rollout state","name":"state","in":"query"},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved release deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseDeploymentsResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels":{"get":{"operationId":"listReleaseChannels","summary":"List release channels","description":"List the release channels configured for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Project release channels.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannel"}}},"required":["items"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createReleaseChannel","summary":"Create a release channel","description":"Create a release channel for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["name"],"additionalProperties":false}}}},"responses":{"201":{"description":"Channel created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"400":{"description":"Invalid release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}/promote":{"post":{"operationId":"promoteRelease","x-speakeasy-group":"releases","x-speakeasy-name-override":"promote","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"expectedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["releaseId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Release promoted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"404":{"description":"Project, channel, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel changed concurrently, or the sandbox bundle its release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}":{"delete":{"operationId":"deleteReleaseChannel","summary":"Delete a release channel","description":"Delete a release channel from a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"204":{"description":"Channel deleted."},"400":{"description":"Reserved channel.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel is still followed by deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments":{"get":{"operationId":"listDeployments","description":"Retrieve all deployments.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"list","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Filter by exact deployment name. Must be used with deploymentGroup."},"required":false,"description":"Filter by exact deployment name. Must be used with deploymentGroup.","name":"name","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name, public subdomain, or deployment group name"},"required":false,"description":"Search deployments by name, public subdomain, or deployment group name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved deployments.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid deployment list filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDeployment","description":"Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewDeploymentRequest"}}}},"responses":{"200":{"description":"Existing deployment returned for idempotent deployment-group registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"201":{"description":"Deployment created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"400":{"description":"Bad request - deployment group has reached max deployments limit.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden - insufficient permissions to create deployments in this context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment group not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/stats":{"get":{"operationId":"getDeploymentStats","description":"Get aggregated deployment statistics. Returns total count and breakdown by status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getStats","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name or deployment group name"},"required":false,"description":"Search deployments by name or deployment group name","name":"search","in":"query"}],"responses":{"200":{"description":"Deployment statistics retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentStats"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-environments":{"get":{"operationId":"listDeploymentFilterEnvironments","description":"List distinct effective environments used by deployments. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterEnvironments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Distinct environments retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-deployment-groups":{"get":{"operationId":"listDeploymentFilterDeploymentGroups","description":"List deployment groups with deployment counts. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterDeploymentGroups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return"},"required":false,"description":"Maximum number of items to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Deployment groups for filter retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"deploymentCount":{"type":"number"},"runningCount":{"type":"number","description":"Number of deployments in 'running' status"},"failedCount":{"type":"number","description":"Number of deployments in a failed status"},"inProgressCount":{"type":"number","description":"Number of deployments in an in-progress status (provisioning, updating, etc.)"}},"required":["id","name","deploymentCount","runningCount","failedCount","inProgressCount"]}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}":{"get":{"operationId":"getDeployment","description":"Retrieve a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentDetailResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/update-operations/{operationId}":{"get":{"operationId":"getDeploymentUpdateOperation","description":"Retrieve a deployment update operation by its durable operation ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getUpdateOperation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"required":true,"description":"Unique identifier for the deployment update operation.","name":"operationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment update operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}}}},"403":{"description":"The credential cannot read this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or update operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/info":{"get":{"operationId":"getDeploymentConnectionInfo","description":"Get deployment connection information including command endpoint and resource URLs.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment connection information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentConnectionInfo"}}}},"400":{"description":"Deployment not ready (no manager assigned).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/import":{"post":{"operationId":"importDeployment","description":"Import a deployment from resolved setup infrastructure such as CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"import","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportDeploymentRequest"}}}},"responses":{"200":{"description":"Deployment import was idempotent and returned an existing deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"201":{"description":"Deployment imported and created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/first-party-inputs":{"put":{"operationId":"setFirstPartyDeploymentInputs","description":"Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setFirstPartyDeploymentInputs","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Input values stored on the session token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsResponse"}}}},"400":{"description":"A deployment-group token scope is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The token is not a first-party deployment session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The requested release channel does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to store input values.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations":{"post":{"operationId":"createSetupRegistrationOperation","description":"Start a durable setup registration operation for CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createSetupRegistrationOperation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupRegistrationOperationRequest"}}}},"responses":{"202":{"description":"Setup registration operation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"400":{"description":"Invalid setup registration operation request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The credential cannot manage this setup registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed before callback acceptance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations/{id}":{"get":{"operationId":"getSetupRegistrationOperation","description":"Get setup registration operation status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getSetupRegistrationOperation","parameters":[{"schema":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"required":true,"description":"Unique identifier for the setup registration operation.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Setup registration operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"403":{"description":"The credential cannot read this setup registration result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Setup registration operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/delete":{"post":{"operationId":"deleteDeployment","description":"Delete, detach, or forget a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentRequest"}}}},"responses":{"202":{"description":"Deployment deletion request accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentResponse"}}}},"400":{"description":"Cannot delete the deployment in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/redeploy":{"post":{"operationId":"redeployDeployment","description":"Redeploy a running deployment with the same release and fresh environment variables. Sets status to update-pending.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"redeploy","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment redeployment triggered successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["message","operation"]}}}},"400":{"description":"Cannot redeploy - deployment must be running.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/pin-release":{"post":{"operationId":"pinDeploymentRelease","description":"Pin or unpin a running or runtime-failed deployment. Running deployments start an update; failed deployments retry toward the selected release.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"pinRelease","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PinReleaseRequest"}}}},"responses":{"202":{"description":"Release pin updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot pin release from the deployment's current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/release-channel":{"post":{"operationId":"setDeploymentReleaseChannel","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setReleaseChannel","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"channel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["channel"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployment release channel updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"400":{"description":"Channel release is unavailable for the deployment platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/retry":{"post":{"operationId":"retryDeployment","description":"Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"retry","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment retry enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Deployment is not in a failed state that can be retried.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment retry conflicts with current execution state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/inputs":{"get":{"operationId":"getDeploymentInputs","description":"Get the active input definitions and current non-secret values for a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment inputs returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInputsResponse"}}}},"403":{"description":"Insufficient permission to read deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentInputs","description":"Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Deployment inputs saved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsResponse"}}}},"400":{"description":"Input values are invalid for the deployment release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, project, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/compute":{"patch":{"operationId":"updateDeploymentCompute","description":"Update deployment-time compute pool selections and request reconciliation by the hosted manager.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateCompute","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentComputeRequest"}}}},"responses":{"200":{"description":"Compute settings saved or already current.","content":{"application/json":{"schema":{"type":"object","properties":{"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["outcome","operation"]}}}},"400":{"description":"Compute settings cannot be changed from the current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update compute settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/environment-variables":{"patch":{"operationId":"updateDeploymentEnvironmentVariables","description":"Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateEnvironmentVariables","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentEnvironmentVariablesRequest"}}}},"responses":{"202":{"description":"Environment variables updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Environment variables are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update environment variables.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/token":{"post":{"operationId":"createDeploymentToken","description":"Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenRequest"}}}},"responses":{"201":{"description":"Deployment token created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenResponse"}}}},"403":{"description":"Forbidden - insufficient permissions to issue a deployment token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}":{"put":{"operationId":"putDynamicContainer","description":"Create or replace a dynamic container in an existing deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"put","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string"},"required":false,"name":"if-match","in":"header"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutDynamicContainerRequest"}}}},"responses":{"202":{"description":"Desired state saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Generation conflict.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"501":{"description":"This deployment does not support dynamic containers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDynamicContainer","description":"Get one dynamic container's desired generation, status, and internal address.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic container.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDynamicContainer","description":"Remove a dynamic container from this deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"deleted":{"type":"boolean","enum":[true]}},"required":["name","deleted"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers":{"get":{"operationId":"listDynamicContainers","description":"List containers created after this deployment was installed.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic containers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}/logs":{"get":{"operationId":"getDynamicContainerLogs","description":"Read recent logs for one dynamic container.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"logs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":10080,"default":60},"required":false,"name":"sinceMinutes","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":200,"default":100},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"}],"responses":{"200":{"description":"Container logs.","content":{"application/json":{"schema":{"type":"object","properties":{"logs":{"type":"array","items":{"type":"object","properties":{"timestamp":{"type":"string","format":"date-time"},"level":{"type":"string"},"message":{"type":"string"},"replicaId":{"type":"string","nullable":true}},"required":["timestamp","level","message","replicaId"]}},"numHits":{"type":"number"},"nextCursor":{"type":"string","nullable":true},"partial":{"type":"boolean"},"errorCount":{"type":"number"}},"required":["logs","numHits","nextCursor","partial","errorCount"]}}}},"400":{"description":"Invalid cursor or time range.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Logs are unavailable for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/machines":{"get":{"operationId":"listDeploymentMachines","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listMachines","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines in every Horizon-backed ComputeCluster for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListDeploymentMachinesResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Horizon inventory could not be read.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation":{"get":{"operationId":"getDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current non-secret rotation state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationStatus"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"prepareDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"expectedRevision":{"type":"integer","minimum":0,"maximum":2147483644}},"required":["expectedRevision"],"additionalProperties":false}}}},"responses":{"200":{"description":"Prepared or replayed rotation; download values explicitly","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/cancel":{"post":{"operationId":"cancelDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Cancelled; apply the newer rollback values to restore the old credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/values":{"post":{"operationId":"getDeploymentCredentialRotationValues","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Secret values for this exact current rotation. Never persist in browser storage.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationValues"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers":{"post":{"operationId":"createManager","description":"Create a new manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewManagerRequest"}}}},"responses":{"201":{"description":"Manager created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Invalid private manager setup method.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A manager for this target already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listManagers","description":"Retrieve all managers.","x-speakeasy-group":"managers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search managers by name"},"required":false,"description":"Search managers by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of managers to return"},"required":false,"description":"Maximum number of managers to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved managers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Manager"}}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/setup-token":{"post":{"operationId":"retryManagerSetup","description":"Revoke previous private-manager setup tokens and issue a fresh setup token/config.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retrySetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"201":{"description":"Fresh manager setup token generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Manager setup cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or setup config not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/retry":{"post":{"operationId":"retryManager","description":"Retry private-manager setup. Returns a fresh setup action before the internal deployment exists, or requests retry for the internal deployment after it exists.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retry","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager retry handled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerRetryResponse"}}}},"400":{"description":"Manager cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or internal deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/cancel-setup":{"post":{"operationId":"cancelManagerSetup","description":"Cancel pending private-manager setup, revoke setup/runtime tokens, and remove the undeployed manager record.","x-speakeasy-group":"managers","x-speakeasy-name-override":"cancelSetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager setup canceled successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Manager setup cannot be canceled in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}":{"get":{"operationId":"getManager","description":"Retrieve a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"get","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Manager"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteManager","description":"Delete a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager deletion enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot delete the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Internal deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/domain-binding":{"get":{"operationId":"getManagerDomainBinding","description":"Get the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager domain binding.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateManagerDomainBinding","description":"Create, update, or remove the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"updateDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerDomainBinding"}}}},"responses":{"200":{"description":"Manager domain binding updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"400":{"description":"Invalid domain binding request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or domain not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/management-config":{"get":{"operationId":"getManagerManagementConfig","description":"Get the management configuration for a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getManagementConfig","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":true,"description":"Represents the target cloud platform.","name":"platform","in":"query"}],"responses":{"200":{"description":"Management config retrieved successfully.","content":{"application/json":{"schema":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/provision":{"post":{"operationId":"provisionManager","description":"Enqueue provisioning for a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"provision","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager provisioning enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot provision the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/update":{"post":{"operationId":"updateManager","description":"Update a manager to a specific release ID or active release.","x-speakeasy-group":"managers","x-speakeasy-name-override":"update","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerRequest"}}}},"responses":{"202":{"description":"Manager update enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot update the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/events":{"get":{"operationId":"listManagerEvents","description":"Retrieve all events of a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"listEvents","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Event"}}},"required":["items"]}}}},"400":{"description":"Manager does not expose user-accessible events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/token":{"post":{"operationId":"generateManagerToken","description":"Generate a short-lived JWT for direct browser → manager communication. Used for fetching command payloads and querying logs without routing sensitive data through the platform API.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenRequest"}}}},"responses":{"200":{"description":"Manager access token and connection info.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/binding-token":{"post":{"operationId":"generateManagerBindingToken","description":"Generate a short-lived deployment-scoped token for resolving opted-in remote bindings through the currently assigned manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerBindingToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenRequest"}}}},"responses":{"200":{"description":"Remote Bindings token and assigned manager URL.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenResponse"}}}},"403":{"description":"The caller cannot access Remote Bindings for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Assigned manager or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A sandbox token was requested but the deployment's current release publishes no remote sandbox, or more than one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed, such as an unknown binding kind.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/gcp-oauth-provider/resolve":{"post":{"operationId":"resolveManagerGcpOAuthProvider","description":"Resolve decrypted project-level Google Cloud OAuth provider settings for a manager-side deployment bootstrap.","x-speakeasy-group":"managers","x-speakeasy-name-override":"resolveGcpOAuthProvider","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderRequest"}}}},"responses":{"200":{"description":"Resolved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderResponse"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Manager cannot resolve this deployment group's project settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/heartbeat":{"post":{"operationId":"reportManagerHeartbeat","description":"Report Manager health status and metrics.","x-speakeasy-group":"managers","x-speakeasy-name-override":"reportHeartbeat","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatRequest"}}}},"responses":{"200":{"description":"Heartbeat acknowledged.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/deployment":{"get":{"operationId":"getManagerDeployment","description":"Get deployment details for a private manager (internal deployment platform, status, resources).","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDeployment","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager deployment details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDeployment"}}}},"404":{"description":"Manager not found or has no internal deployment (alien-hosted managers don't have deployment info).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/snapshot":{"get":{"operationId":"getContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"responses":{"200":{"description":"Complete desired registry snapshot assigned to this Manager","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryManagerSnapshot"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/applied":{"post":{"operationId":"applyContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"routeId":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"desiredRevision":{"type":"integer","minimum":0},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"status":{"type":"string","enum":["ready","deleted","failed"]},"routableUpstreamName":{"type":"string","nullable":true,"minLength":1},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["id","status","routableUpstreamName","error"],"additionalProperties":false}},"verification":{"type":"object","nullable":true,"properties":{"succeeded":{"type":"boolean"},"observedAt":{"type":"string","format":"date-time"},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["succeeded","observedAt","error"],"additionalProperties":false}},"required":["routeId","desiredRevision","repositories","verification"],"additionalProperties":false}}}},"responses":{"200":{"description":"Applied registry snapshot revision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplyContainerRegistrySnapshotResponse"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/prepare":{"post":{"operationId":"prepareOperatorManifestPackage","tags":["operator-manifests"],"summary":"Prepare the white-labeled Operator image for an Operate install","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageRequest"}}}},"responses":{"200":{"description":"Operator image package created or reused.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/render":{"post":{"operationId":"renderOperatorManifest","tags":["operator-manifests"],"summary":"Render a Kubernetes Operator manifest","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestRequest"}}}},"responses":{"200":{"description":"Operator manifest rendered successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestResponse"}}}},"400":{"description":"An enabled custom plugin has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Operator image package is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid platform or manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/bootstrap-write-check":{"post":{"operationId":"checkEcsBootstrapWrite","tags":["operator-manifests"],"description":"Checks a Remote Operator setup token and its exact AWS target before the local bootstrap command writes a registration secret. A registered stack cannot use this path.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EcsBootstrapWriteCheckRequest"}}}},"responses":{"204":{"description":"The setup token may write the bootstrap secret."},"400":{"description":"The AWS target is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"The setup token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The setup token cannot read this deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The setup token does not match the target or the stack has registered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/render":{"post":{"operationId":"renderOperatorEcsCloudFormation","tags":["operator-manifests"],"summary":"Render a Remote Operator ECS Fargate CloudFormation installer","description":"Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from the project's enabled operations; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationRequest"}}}},"responses":{"200":{"description":"CloudFormation installer rendered, or null template and deployCommand while imagePending is true.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationResponse"}}}},"400":{"description":"Enabled AWS permissions cannot be safely compiled or directly deployed with the supplied resource ceilings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not authorized to update the project or use the selected Operator image package.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Operator image package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The selected Operator image package is unavailable, or the registered stack belongs to a different ECS cluster.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request body validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid Operator image or AWS manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys":{"get":{"operationId":"listAPIKeys","description":"Retrieve all API keys for the current workspace.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved API keys.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/APIKey"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAPIKey","description":"Create a new API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyRequest"}}}},"responses":{"201":{"description":"API key created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyResponse"}}}},"403":{"description":"Insufficient permissions to create API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/{id}":{"get":{"operationId":"getAPIKey","description":"Retrieve a specific API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateAPIKey","description":"Update an API key (enable/disable, change description).","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateAPIKeyRequest"}}}},"responses":{"200":{"description":"API key updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeAPIKey","description":"Revoke (soft delete) an API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"revoke","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"API key revoked successfully."},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/batch-delete":{"post":{"operationId":"deleteAPIKeys","description":"Permanently delete multiple API keys.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"deleteMultiple","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteAPIKeysRequest"}}}},"responses":{"200":{"description":"API keys deleted successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"deletedCount":{"type":"number"}},"required":["deletedCount"]}}}},"403":{"description":"Insufficient permissions to delete API keys.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains":{"get":{"operationId":"listDomains","description":"List system domains and workspace domains.","x-speakeasy-group":"domains","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domains.","content":{"application/json":{"schema":{"type":"object","properties":{"domains":{"type":"array","items":{"$ref":"#/components/schemas/DomainWithUsage"}}},"required":["domains"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDomain","description":"Create a workspace domain and optional initial endpoints.","x-speakeasy-group":"domains","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"setup":{"type":"object","properties":{"deploymentPortal":{"type":"boolean"},"packages":{"type":"boolean"},"deploymentUrlProjectId":{"type":"string","nullable":true,"pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"managerIds":{"type":"array","items":{"type":"string"}}}}},"required":["domain"]}}}},"responses":{"200":{"description":"Returned an existing workspace domain claim.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"201":{"description":"Created domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Domain is reserved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/endpoints":{"post":{"operationId":"createDomainEndpoint","description":"Create an endpoint under a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"createEndpoint","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"owner":{"type":"object","properties":{"type":{"type":"string","enum":["workspace","project","manager"]},"id":{"type":"string"}},"required":["type","id"]}},"required":["kind"]}}}},"responses":{"201":{"description":"Created endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Bad request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Endpoint cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}":{"get":{"operationId":"getDomain","description":"Get domain by ID.","x-speakeasy-group":"domains","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDomain","description":"Delete a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}},"required":["success"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain is in use.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/refresh":{"post":{"operationId":"refreshDomain","description":"Refresh workspace domain verification.","x-speakeasy-group":"domains","x-speakeasy-name-override":"refresh","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain verification refresh requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events":{"get":{"operationId":"listEvents","description":"Retrieve all events.","x-speakeasy-group":"events","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter events to a single deployment."},"required":false,"description":"Filter events to a single deployment.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Filter events to a single release."},"required":false,"description":"Filter events to a single release.","name":"releaseId","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["releaseCreatedAt"]},"description":"Optional fields to include: releaseCreatedAt"},"required":false,"description":"Optional fields to include: releaseCreatedAt","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/EventListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events/{id}":{"get":{"operationId":"getEvent","description":"Retrieve an event by ID.","x-speakeasy-group":"events","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"required":true,"description":"Unique identifier for the event.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved event.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Event"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents":{"get":{"operationId":"listIncidents","description":"List authorized incidents without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string"},"required":false,"name":"projectId","in":"query"},{"schema":{"type":"string","enum":["queued","running","halted","complete","error","canceled"]},"required":false,"name":"status","in":"query"},{"schema":{"type":"string","maxLength":256},"required":false,"name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":25},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incidents.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentListResponse"}}}},"400":{"description":"Invalid request or cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents/{id}":{"get":{"operationId":"getIncident","description":"Get an authorized incident without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incident.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Incident not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens":{"get":{"operationId":"listMachinesJoinTokens","x-speakeasy-group":"machines","x-speakeasy-name-override":"listJoinTokens","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Join tokens for a Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMachinesJoinTokensResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"createJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Newly minted Machines join token. Existing tokens keep working; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/rotate":{"post":{"operationId":"rotateMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"rotateJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Rotated Machines join token. Revokes all existing tokens, then mints a new one; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/{tokenId}":{"delete":{"operationId":"revokeMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"revokeJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"tokenId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines join token revocation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}/drain":{"delete":{"operationId":"cancelMachinesMachineDrain","x-speakeasy-group":"machines","x-speakeasy-name-override":"cancelMachineDrain","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines drain cancellation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelMachinesMachineDrainResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"drainMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"drainMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineRequest"}}}},"responses":{"200":{"description":"Machines drain request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}":{"delete":{"operationId":"removeMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"removeMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines remove request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoveMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/bootstrap":{"post":{"operationId":"bootstrapCommands","description":"Resolve a deployment's current manager and mint a five-minute command capability. Sender tokens can dispatch and observe commands only for this deployment. Receiver tokens can lease and complete commands only for the resolved Container or Daemon target.","x-speakeasy-group":"commands","x-speakeasy-name-override":"bootstrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapRequest"}}}},"responses":{"200":{"description":"Manager connection details and a short-lived command capability.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapResponse"}}}},"400":{"description":"Invalid request or deployment state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot operate this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, manager, or receiver target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The selected resource cannot run an external receiver.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands":{"get":{"operationId":"listCommands","description":"Retrieve commands. Use for dashboard analytics and command history.","x-speakeasy-group":"commands","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Filter by command state"},"required":false,"description":"Filter by command state","name":"state","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Filter by command name"},"required":false,"description":"Filter by command name","name":"name","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search commands by name"},"required":false,"description":"Search commands by name","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created after this date (ISO 8601)"},"required":false,"description":"Filter commands created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created before this date (ISO 8601)"},"required":false,"description":"Filter commands created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deployment","project"]},"description":"Optional fields to include: deployment, project"},"required":false,"description":"Optional fields to include: deployment, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved commands.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/CommandListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createCommand","description":"Create command metadata. Called by manager when processing commands. Returns project info for routing decisions.","x-speakeasy-group":"commands","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandRequest"}}}},"responses":{"201":{"description":"Command created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandResponse"}}}},"400":{"description":"Deployment is not ready or has no assigned manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The operation access request is no longer approved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The deployment manager is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/names":{"get":{"operationId":"listCommandNames","description":"List distinct command names. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listNames","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search command names (prefix match)"},"required":false,"description":"Search command names (prefix match)","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct command names.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandNamesResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/deployments":{"get":{"operationId":"listCommandDeployments","description":"List distinct deployments that have commands, including deployment group info. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search deployment or deployment group names"},"required":false,"description":"Search deployment or deployment group names","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct deployments that have commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandDeploymentsResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/target":{"get":{"operationId":"resolveCommandTarget","description":"Resolve which resource a command for this deployment would be addressed to, and how it would be delivered. Fails when the deployment has no command-capable resources, or more than one and no explicit target was named.","x-speakeasy-group":"commands","x-speakeasy-name-override":"resolveTarget","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment to resolve the target for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Deployment to resolve the target for","name":"deploymentId","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Explicit resource id to resolve; must be a command-capable resource"},"required":false,"description":"Explicit resource id to resolve; must be a command-capable resource","name":"target","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":255,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead."},"required":false,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead.","name":"command","in":"query"}],"responses":{"200":{"description":"Resolved command target.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolvedCommandTarget"}}}},"404":{"description":"Deployment or target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}":{"patch":{"operationId":"updateCommand","description":"Update command state. Called by manager when command is dispatched or completes.","x-speakeasy-group":"commands","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateCommandRequest"}}}},"responses":{"200":{"description":"Command updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getCommand","description":"Retrieve a command by ID.","x-speakeasy-group":"commands","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["true"],"description":"Explicitly confirm access to an operation result marked sensitive."},"required":false,"description":"Explicitly confirm access to an operation result marked sensitive.","name":"confirmSensitiveOutput","in":"query"}],"responses":{"200":{"description":"Retrieved command.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid operation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/dispatch":{"post":{"operationId":"dispatchCommand","description":"Atomically mark a command DISPATCHED unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"dispatch","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandRequest"}}}},"responses":{"200":{"description":"Dispatch attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/complete":{"post":{"operationId":"completeCommand","description":"Atomically transition a command to a terminal state (SUCCEEDED, FAILED, or EXPIRED) unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"complete","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandRequest"}}}},"responses":{"200":{"description":"Completion attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/increment-attempt":{"post":{"operationId":"incrementCommandAttempt","description":"Atomically increment the command's attempt counter and return the new value.","x-speakeasy-group":"commands","x-speakeasy-name-override":"incrementAttempt","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Attempt incremented.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncrementCommandAttemptResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions":{"get":{"operationId":"listDebugSessions","description":"Retrieve debug sessions for dashboard audit. Filters: project, deployment, state, mode.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Filter by session state"}]},"required":false,"description":"Filter by session state","name":"state","in":"query"},{"schema":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model (push/pull). Joins against the parent deployment."},"required":false,"description":"Filter by deployment model (push/pull). Joins against the parent deployment.","name":"mode","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Filter by cloud provider. Joins against the parent deployment."},"required":false,"description":"Filter by cloud provider. Joins against the parent deployment.","name":"provider","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Paginated debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSessionListResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDebugSession","description":"Create a debug-session audit row. Called by the manager when a pull or push debug tunnel is opened. Workspace + project derived from deployment.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDebugSessionRequest"}}}},"responses":{"201":{"description":"Debug session created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Deployment or access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions/{id}":{"patch":{"operationId":"updateDebugSession","description":"Update debug-session state. Called by manager on tunnel attach, close, or deadline expiry.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDebugSessionRequest"}}}},"responses":{"200":{"description":"Debug session updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Debug session not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDebugSession","description":"Retrieve a debug session by ID.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved debug session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info":{"get":{"operationId":"getDeploymentInfo","description":"Get deployment information for the deployment portal. Accepts both deployment-scoped and deployment-group-scoped API keys. Returns project information, package status/outputs, and either deployment or deployment group details depending on the token type. Poll this endpoint to check if packages are ready.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":false,"description":"Represents the target cloud platform.","name":"platform","in":"query"},{"schema":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":false,"name":"setupItem","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"updateOperationId","in":"query"}],"responses":{"200":{"description":"Deployment information retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInfo"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-scoped or deployment-group-scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/compute-plan":{"post":{"operationId":"planDeploymentCompute","description":"Plan deployment compute for the active release before stack preparation. The response contains recommended machine and scale choices for cloud compute pools.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"planCompute","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Compute plan returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentComputePlan"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/prepare-stack":{"post":{"operationId":"prepareDeploymentStack","description":"Prepare the active release stack for a deployment portal setup session. The response contains the generated stack shape plus setup compatibility metadata.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"prepareStack","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"saveForSetup":{"type":"boolean","description":"Persist validated choices for the exact blocked update; does not apply cloud changes."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Prepared stack returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PreparedDeploymentStack"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/install-url":{"post":{"operationId":"slackIntegrationInstallUrl","description":"Generate the Slack OAuth consent URL for this workspace.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"installUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"OAuth URL the dashboard should redirect the user to.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackInstallUrlResponse"}}}},"500":{"description":"Server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/status":{"get":{"operationId":"slackIntegrationStatus","description":"Return the Slack install for this workspace (if any).","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"status","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackIntegrationStatus"}}}}}}},"/v1/integrations/slack/channels":{"get":{"operationId":"slackIntegrationChannels","description":"List public Slack channels for this workspace's install. Used by the dashboard's notification-channel picker.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"listChannels","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Public channels.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackChannelsResponse"}}}},"400":{"description":"Workspace not connected to Slack.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/notification-channel":{"put":{"operationId":"slackIntegrationSetNotificationChannel","description":"Configure which Slack channel receives ai-agent monitor reports.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"setNotificationChannel","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelRequest"}}}},"responses":{"200":{"description":"Channel saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelResponse"}}}},"400":{"description":"Not connected, or join failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/installation":{"delete":{"operationId":"slackIntegrationUninstall","description":"Uninstall the Slack integration for this workspace. Revokes the bot token at Slack and deletes the row.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"uninstall","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Uninstalled."}}}},"/v1/agent-sessions":{"get":{"operationId":"listAgentSessions","description":"List ai-agent monitor sessions for this workspace, or for one project. Newest first, capped at 50.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},{"description":"Only sessions bound to this project. Omit to list the whole workspace."}]},"required":false,"description":"Only sessions bound to this project. Omit to list the whole workspace.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionListResponse"}}}}}}},"/v1/agent-sessions/{id}":{"get":{"operationId":"getAgentSession","description":"Retrieve one ai-agent monitor session by id.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionDetail"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/events":{"get":{"operationId":"listAgentSessionEvents","description":"Incrementally read a session's event log (steps, tool calls, report deltas, approvals, status transitions). Pass the previous response's `latestSeq` as `after` to fetch only new events.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"events","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","nullable":true,"minimum":0,"default":0},"required":false,"name":"after","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":500,"default":200},"required":false,"name":"limit","in":"query"}],"responses":{"200":{"description":"Events after the cursor, oldest first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionEventsResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/stop":{"post":{"operationId":"stopAgentSession","description":"Stop (cancel) a running or queued ai-agent monitor session. Proxies to the ai-agent service, minting a fresh CLI session for the caller so the ai-agent's own auth applies. Idempotent — stopping an already-terminal session is a 200 no-op.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"stop","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Already terminal / no-op.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"202":{"description":"Cancel accepted; session stopped.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"AI agent service is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins":{"get":{"operationId":"listOperationsPlugins","description":"List available operations plugins (builtin + custom) for a project, with their operations and risk tiers.","x-speakeasy-group":"operations","x-speakeasy-name-override":"listPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The operations plugin catalog.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListOperationsPluginsResponse"}}}},"409":{"description":"A persisted custom plugin has invalid metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"publishOperationsPlugin","description":"Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"publishPlugin","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginRequest"}}}},"responses":{"201":{"description":"The plugin was published, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginResponse"}}}},"400":{"description":"Invalid metadata, or no bundle was uploaded for this name/version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A plugin with this name is already published at this version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/builtin/enabled":{"put":{"operationId":"setBuiltinOperationsPlugins","description":"Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setBuiltinPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsRequest"}}}},"responses":{"200":{"description":"The enabled built-in plugin set was replaced, with the cloud permission delta.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsResponse"}}}},"400":{"description":"One or more plugin names are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/upload-url":{"post":{"operationId":"createOperationsBundleUploadUrl","description":"Get a presigned S3 URL to upload a custom operations plugin bundle ZIP. Upload the ZIP with a PUT to the returned url (sending the given Content-Type), then call POST /plugins to register it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"createBundleUploadUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlRequest"}}}},"responses":{"200":{"description":"A presigned upload URL for the bundle ZIP.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlResponse"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Bundle storage is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/{name}/enabled":{"patch":{"operationId":"setOperationsPluginEnabled","description":"Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setPluginEnabled","parameters":[{"schema":{"type":"string","description":"Plugin name."},"required":true,"description":"Plugin name.","name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledRequest"}}}},"responses":{"200":{"description":"The plugin's enabled state was updated, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledResponse"}}}},"404":{"description":"No such plugin for this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The plugin metadata is invalid for the requested enabled state, or the permission delta differs from `expectedPermissionDiff`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/policy":{"get":{"operationId":"getOperationsPolicy","description":"Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"getPolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The approval policy rules and default.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateOperationsPolicy","description":"Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"updatePolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateOperationsPolicyRequest"}}}},"responses":{"200":{"description":"The updated approval policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/invoke":{"post":{"operationId":"invokeOperation","description":"Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"invoke","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationRequest"}}}},"responses":{"200":{"description":"The operation was dispatched or queued for approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationResponse"}}}},"400":{"description":"Parameters do not satisfy the operation's published input schema.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not create commands for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Plugin or operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Plugin is disabled or has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/verify-check":{"post":{"operationId":"verifyOperationCheck","description":"One verification poll cycle for an original operation command. Loads that command's authoritative stored result and dispatch-time verification contract, dispatches the frozen read-only poll operation once, and evaluates its frozen success condition. Callers poll this repeatedly per the returned policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"verifyCheck","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckRequest"}}}},"responses":{"200":{"description":"The outcome of this single verification poll cycle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckResponse"}}}},"400":{"description":"The verification command cannot be dispatched to the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not dispatch verification commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or original command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid verification command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests":{"post":{"operationId":"createAccessRequest","description":"Create an access request — either plan-backed (an ai-agent investigation's exact commands) or plan-less (a CLI-originated exact operation or wildcard pattern, resolved and frozen here). Plan-backed requests await the engineer gate (status `pending-approval`); plan-less requests are queued immediately since the requester is asking for their own access (status `queued`).","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAccessRequest"}}}},"responses":{"201":{"description":"The created access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"400":{"description":"Invalid create payload or requested expiry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The requester cannot access the target deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or remediation plan not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Replay key payload conflicts or the remediation plan already has a request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listAccessRequests","description":"List a project's access requests, newest first.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AccessRequestStatus"},"description":"Filter by status."},"required":false,"description":"Filter by status.","name":"status","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Only requests proposed by this investigation's remediation plan."},"required":false,"description":"Only requests proposed by this investigation's remediation plan.","name":"agentSessionId","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"The project's access requests.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/queue":{"post":{"operationId":"queueAccessRequest","description":"Engineer gate — approve a pending access request, queuing it for the operator to materialize. Records who queued it.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The queued access request, with the customer approve command.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"kubectlApprove":{"type":"string","nullable":true}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","kubectlApprove"]}}}},"400":{"description":"The requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not pending approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/approve":{"post":{"operationId":"approveAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may approve a queued access request. Actor identity comes from authentication; method/source are audit context only.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}},"approvedForMinutes":{"type":"integer","minimum":0,"exclusiveMinimum":true}},"required":["method"]}}}},"responses":{"200":{"description":"The approved access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"approvalMethod":{"$ref":"#/components/schemas/AccessRequestApprovalMethod"}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","approvalMethod"]}}}},"400":{"description":"The approval window or requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued, or its requester identity is unknown and a new request is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/deny":{"post":{"operationId":"denyAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may reject a queued access request. Actor identity comes from authentication.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}}},"required":["method"]}}}},"responses":{"200":{"description":"The rejected access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued (already approved, denied, expired, or still pending the engineer gate).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/coordinates":{"get":{"operationId":"getAccessRequestCoordinates","description":"The customer's kubectl approve command for a queued access request, or null until the operator has materialized the grant CR and reported its coordinates. Polled by the Slack handler to update the access-plan card.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The approve command (or null) and current status.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"kubectlApprove":{"type":"string","nullable":true}},"required":["status","kubectlApprove"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/pending":{"get":{"operationId":"listPendingAccessRequests","description":"Operator-facing: queued access requests whose requester deadline has not elapsed, for the access-request sync loop to materialize as grant CRs.","x-speakeasy-ignore":true,"parameters":[{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Queued access requests for the deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"requests":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"requestedExpiresAt":{"type":"string","nullable":true}},"required":["id","title","reason","commands","debugGrant","requestedExpiresAt"]}},"revokedRequestIds":{"type":"array","items":{"type":"string"},"description":"Requests revoked in the last six hours, or revoked while their approved window is still open, so the operator can mark their grant CRs REVOKED. Older operators ignore this field."}},"required":["requests","revokedRequestIds"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/materialized":{"post":{"operationId":"reportMaterializedAccessRequests","description":"Operator-facing: record the namespace + CRD plural the operator materialized the grant CRs in, so the control plane can render the customer's exact kubectl approve command.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"requestIds":{"type":"array","items":{"type":"string"}},"namespace":{"type":"string","minLength":1},"resourcePlural":{"type":"string","minLength":1}},"required":["deploymentId","requestIds","namespace","resourcePlural"]}}}},"responses":{"200":{"description":"Number of requests updated with CR coordinates.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/approvals":{"post":{"operationId":"reportAccessApprovals","description":"Operator-facing: record the customer's approval windows reported back by the sync loop. Retires requester-expired requests and skips stale windows without blocking live approvals. Moves live requests to customer-approved and resumes the investigation to dispatch commands.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"approvals":{"type":"array","items":{"type":"object","properties":{"requestId":{"type":"string"},"approvedUntil":{"type":"string"}},"required":["requestId","approvedUntil"]}}},"required":["deploymentId","approvals"]}}}},"responses":{"200":{"description":"Number of approvals recorded.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"400":{"description":"Invalid approval report payload.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/live-debug-grant":{"get":{"operationId":"getLiveDebugGrant","description":"Find an approved, unexpired access request the caller created whose debug grant matches this deployment and tool (and, when given, namespace/cloudScope). Returns the most recently approved match, or 404 when none is live. Used to reuse an existing grant instead of proposing a new access request. Only the requester's own grants match: a debug session must present a grant its caller requested, so another principal's grant is never returned here.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"The deployment to check for a live debug grant.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"The deployment to check for a live debug grant.","name":"deploymentId","in":"query"},{"schema":{"$ref":"#/components/schemas/DebugGrantTool"},"required":true,"name":"debugTool","in":"query"},{"schema":{"type":"string","description":"Match a `kubectl` grant scoped to this namespace exactly."},"required":false,"description":"Match a `kubectl` grant scoped to this namespace exactly.","name":"debugNamespace","in":"query"},{"schema":{"type":"string","description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly."},"required":false,"description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly.","name":"debugCloudScope","in":"query"}],"responses":{"200":{"description":"A live access request with a matching debug grant.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"No approved, unexpired access request matches.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/activity":{"get":{"operationId":"getAccessRequestActivity","description":"The operation commands and debug sessions an access request authorized, with each command's verification outcome. Authorized like getAccessRequest.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The request's operations and debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRequestActivity"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/revoke":{"post":{"operationId":"revokeAccessRequest","description":"Revoke a pending, queued or customer-approved access request. The principal that created the request, or any workspace member or administrator who can read its project, may revoke it. Commands the grant authorized that have not been dispatched are failed; dispatched commands finish. Linked debug sessions are stopped and refuse their next request. Revoking an already revoked request returns it unchanged.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeAccessRequest"}}}},"responses":{"200":{"description":"The revoked access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"The caller may read but not revoke this request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The request has already expired or been rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}":{"get":{"operationId":"getAccessRequest","description":"Get an access request by id.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/list":{"post":{"operationId":"syncList","description":"List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.","x-speakeasy-group":"sync","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListRequest"}}}},"responses":{"200":{"description":"Full deployment records returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/context":{"post":{"operationId":"syncContext","description":"Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.","x-speakeasy-group":"sync","x-speakeasy-name-override":"context","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncContextRequest"}}}},"responses":{"200":{"description":"Computed deployment context returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"}}}},"404":{"description":"Deployment not found or not assigned to this manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to build deployment context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/acquire":{"post":{"operationId":"syncAcquire","description":"Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.","x-speakeasy-group":"sync","x-speakeasy-name-override":"acquire","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireRequest"}}}},"responses":{"200":{"description":"Deployments acquired successfully (empty arrays if none available). Failures indicate deployments that were locked but failed during context building - their locks have been released.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/reconcile":{"post":{"operationId":"syncReconcile","description":"Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.","x-speakeasy-group":"sync","x-speakeasy-name-override":"reconcile","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileRequest"}}}},"responses":{"200":{"description":"State reconciled successfully. If target is present, continue deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment locked (pull) or session mismatch (push).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/renew":{"post":{"operationId":"syncRenew","x-speakeasy-group":"sync","x-speakeasy-name-override":"renew","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncRenewRequest"}}}},"responses":{"200":{"description":"Renewal processed. Inspect `leases` for per-deployment outcomes; a lost lease is reported there rather than failing the whole batch.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when every requested deployment was renewed."},"leases":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"renewed":{"type":"boolean","description":"False when this session no longer holds a live lease."},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["deploymentId","renewed","leaseExpiresAt"]},"description":"Per-deployment renewal outcome."}},"required":["success","leases"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The session no longer owns the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/release":{"post":{"operationId":"syncRelease","description":"Release a deployment lock. Must be called after processing an acquired deployment, even if processing failed. This is critical to avoid deadlocks.","x-speakeasy-group":"sync","x-speakeasy-name-override":"release","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReleaseRequest"}}}},"responses":{"200":{"description":"Lock released successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when released or the exact terminal receipt was acknowledged. False when completion could not be established."}},"required":["success"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources":{"get":{"operationId":"listInventory","x-speakeasy-group":"resources","x-speakeasy-name-override":"listInventory","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Unified managed and observed resource inventory rows.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"},"source":{"type":"string","enum":["managed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt","source","deploymentId","deploymentName"]},{"type":"object","properties":{"source":{"type":"string","enum":["observed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"rawKind":{"type":"string"},"alienResourceId":{"type":"string","nullable":true},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["source","deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","name","rawKind","alienResourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}":{"get":{"operationId":"listResourceOverview","x-speakeasy-group":"resources","x-speakeasy-name-override":"listOverview","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Compute resource overview rows from latest heartbeats.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/{resourceId}/deployments":{"get":{"operationId":"listResourceDeployments","description":"List deployments where the selected resource is installed.","x-speakeasy-group":"resources","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Deployments where the resource is installed.","content":{"application/json":{"schema":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"deployments":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt"]}}},"required":["resourceType","resourceId","deployments"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/deployments/{deploymentId}/{resourceId}":{"get":{"operationId":"getResourceDeploymentDetail","x-speakeasy-group":"resources","x-speakeasy-name-override":"getDeploymentDetail","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Latest heartbeat detail for one resource deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"deployment":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"},"desiredImage":{"type":"string","nullable":true}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt","desiredImage"]},"heartbeat":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"staleAt":{"type":"string","format":"date-time"},"platformStale":{"type":"boolean"},"heartbeat":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"raw":{"type":"array","items":{"nullable":true}}},"required":["status","deploymentId","resourceId","resourceType","backend","controllerPlatform","observedAt","staleAt","platformStale","heartbeat","raw"]},{"type":"object","properties":{"status":{"type":"string","enum":["missing"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"}},"required":["status","deploymentId","resourceId","resourceType"]}]}},"required":["deployment","heartbeat"]}}}},"404":{"description":"Deployment or resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys":{"get":{"operationId":"listAwsVirtualKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"AWS Virtual Keys in a project","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKeys":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}},"required":["virtualKeys"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAwsVirtualKey","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"selector":{"oneOf":[{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false}]},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128},"alias":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"description":{"type":"string","nullable":true,"maxLength":8192},"deletionWindowDays":{"type":"integer","minimum":7,"maximum":30,"default":30},"tags":{"type":"object","additionalProperties":{"type":"string","maxLength":256},"default":{}}},"required":["selector","awsAccountId","awsRegion","idempotencyKey"]}}}},"responses":{"200":{"description":"Created or resumed Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Enterprise Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Gateway unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/rotate-credential":{"post":{"operationId":"rotateAwsVirtualKeyCredential","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"generation":{"type":"integer","minimum":2}},"required":["generation"]}}}},"responses":{"200":{"description":"The resumable XKS proxy credential rotation bundle","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot begin rotation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/restore":{"post":{"operationId":"restoreAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key awaiting a successful AWS XKS canary after restore","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot be restored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/finalize-deletion":{"post":{"operationId":"finalizeAwsVirtualKeyDeletion","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key whose final AWS KMS deletion was observed","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key deletion cannot be finalized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/decommission":{"post":{"operationId":"decommissionAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"},"deletionScheduledAt":{"type":"string","format":"date-time"}},"required":["kmsKeyArn","deletionScheduledAt"]}}}},"responses":{"200":{"description":"Virtual Key with AWS deletion scheduled","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"AWS key does not match","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}":{"get":{"operationId":"getAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"responses":{"200":{"description":"AWS Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/continue":{"post":{"operationId":"continueAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"customKeyStoreId":{"type":"string","pattern":"^cks-[A-Za-z0-9]+$"},"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["customKeyStoreId","kmsKeyArn"]}}}},"responses":{"200":{"description":"Updated AWS setup facts","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Setup facts conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resolve":{"get":{"operationId":"resolve","tags":["resolve"],"summary":"Resolve manager for a project and platform","description":"Returns the manager URL for a given project and platform. The project can be provided as a query parameter, or derived from the token's scope (project-scoped, deployment-group-scoped, or deployment-scoped tokens carry an implicit project). This is the single entry point for all CLI tools to discover which manager to talk to.","x-speakeasy-group":"resolve","x-speakeasy-name-override":"resolve","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform to resolve the manager for"},"required":true,"description":"Target platform to resolve the manager for","name":"platform","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope)."},"required":false,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope).","name":"project","in":"query"}],"responses":{"200":{"description":"Manager resolved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveResponse"}}}},"400":{"description":"Missing required project parameter for this token type.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found or no manager available for platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Manager not ready yet (no URL reported). Retry after a delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/cloud-regions":{"get":{"operationId":"getCloudRegions","description":"Get cloud regions supported by this Alien environment.","x-speakeasy-group":"cloudRegions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Supported cloud regions retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudRegionsResponse"}}}}}}},"/v1/billing/audit-log":{"get":{"operationId":"listBillingAuditLog","description":"List billing activity entries for the current workspace.","x-speakeasy-group":"billing","x-speakeasy-name-override":"listAuditLog","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"number","minimum":1,"maximum":200,"default":50},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor: id from the previous page."},"required":false,"description":"Cursor: id from the previous page.","name":"before","in":"query"}],"responses":{"200":{"description":"Audit-log rows newest-first.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/BillingAuditLogRow"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"]}}}}}}},"/v1/billing/entitlements":{"get":{"operationId":"getWorkspaceBillingEntitlements","description":"Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.","x-speakeasy-group":"billing","x-speakeasy-name-override":"getEntitlements","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace billing entitlements.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceBillingEntitlements"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/gateways/{gateway}/overview":{"get":{"operationId":"getWorkspaceGatewayOverview","description":"Get compact cross-Project setup and customer status for a workspace Gateway.","x-speakeasy-group":"gateways","x-speakeasy-name-override":"getWorkspaceOverview","parameters":[{"schema":{"$ref":"#/components/schemas/GatewayKind"},"required":true,"description":"Alien Gateway a customer deployment runs","name":"gateway","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace Gateway overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceGatewayOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}}}}
+{"openapi":"3.0.0","info":{"title":"Alien API","version":"1.0.0","contact":{"name":"Alien Team","url":"https://alien.dev"}},"servers":[{"url":"https://api.alien.dev","description":"Alien API - Production"}],"security":[{"apiKey":[]}],"components":{"securitySchemes":{"apiKey":{"type":"http","scheme":"bearer","bearerFormat":"API key","description":"API key for authentication, must be provided as a Bearer token. Generate an API key at https://alien.dev/api-keys"}},"schemas":{"WorkspaceInvitationPreview":{"type":"object","properties":{"kind":{"type":"string","enum":["email","link"]},"workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name","logoUrl"]},"inviter":{"type":"object","nullable":true,"properties":{"name":{"type":"string"},"image":{"type":"string","nullable":true,"format":"uri"}},"required":["name","image"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"state":{"type":"string","enum":["active","accepted","expired","revoked"]},"emailHint":{"type":"string","nullable":true}},"required":["kind","workspace","inviter","role","expiresAt","state","emailHint"],"additionalProperties":false},"WorkspaceRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"Role for workspace-scoped service accounts","example":"workspace.member"},"APIError":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"requestId":{"type":"string","description":"Request ID echoed in the x-request-id response header and server logs."}},"required":["code","message","internal"]},"Membership":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"role":{"type":"string"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","logoUrl","role","createdAt"],"additionalProperties":false},"UserProfile":{"type":"object","properties":{"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","description":"User's email address"},"name":{"type":"string","description":"User's display name"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"},"githubUsername":{"type":"string","nullable":true,"description":"Linked GitHub username"},"cliConnected":{"type":"boolean","description":"Whether this user has ever authenticated a request from the Alien CLI. Latched on first CLI request, never cleared."},"company":{"type":"string","nullable":true,"description":"Company name collected during profile setup."},"acquisitionSource":{"type":"string","nullable":true,"enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other",null],"description":"How the user heard about Alien."},"acquisitionSourceDetail":{"type":"string","nullable":true,"description":"Additional acquisition source detail when the source is other."},"useCases":{"type":"string","nullable":true,"description":"What the user is hoping to use Alien for."},"profileSetupCompletedAt":{"type":"string","format":"date-time","nullable":true,"description":"When the user completed the required profile setup dialog."},"profileSetupVersion":{"type":"integer","nullable":true,"description":"Version of the required profile setup dialog the user completed."}},"required":["id","email","name","image","githubUsername","cliConnected","company","acquisitionSource","acquisitionSourceDetail","useCases","profileSetupCompletedAt","profileSetupVersion"],"additionalProperties":false},"UserProfileSetupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"},"company":{"type":"string","minLength":1,"maxLength":120,"description":"Company name"},"acquisitionSource":{"type":"string","enum":["github","x-twitter","linkedin","hacker-news","reddit","search","friend-or-colleague","founder","event-or-community","other"],"description":"How the user heard about Alien"},"acquisitionSourceDetail":{"type":"string","minLength":1,"maxLength":200,"description":"Required when acquisitionSource is other"},"useCases":{"type":"string","maxLength":2000,"description":"What the user is hoping to use Alien for"}},"required":["name","company","acquisitionSource"],"additionalProperties":false},"GitNamespace":{"type":"object","properties":{"id":{"type":"number","nullable":true},"name":{"type":"string"},"slug":{"type":"string"},"installationId":{"type":"number","nullable":true},"type":{"type":"string","enum":["team","user"]},"provider":{"type":"string","enum":["github"]},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","slug","installationId","type","provider","createdAt"],"additionalProperties":false},"GitRepository":{"type":"object","properties":{"name":{"type":"string"},"private":{"type":"boolean"},"defaultBranch":{"type":"string"},"pushedAt":{"type":"string","format":"date-time"}},"required":["name","private","defaultBranch"],"additionalProperties":false},"AcceptWorkspaceInvitationResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["joined","already-member"]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"workspaceName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["outcome","workspaceId","workspaceName","role"],"additionalProperties":false},"Subject":{"oneOf":[{"$ref":"#/components/schemas/UserSubject"},{"$ref":"#/components/schemas/ServiceAccountSubject"}],"discriminator":{"propertyName":"kind","mapping":{"user":"#/components/schemas/UserSubject","serviceAccount":"#/components/schemas/ServiceAccountSubject"}},"description":"Authenticated principal that can be either a user (with workspace-scoped permissions) or a service account (with configurable scope and role)"},"UserSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["user"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique user identifier"},"email":{"type":"string","format":"email","description":"User's email address"},"workspaceId":{"type":"string","description":"ID of the workspace the user is authenticated within"},"workspaceName":{"type":"string","description":"Name of the workspace the user is authenticated within"},"role":{"$ref":"#/components/schemas/UserRole"}},"required":["kind","id","email","workspaceId","role"],"description":"Authenticated user subject with workspace-scoped permissions"},"UserRole":{"type":"string","enum":["workspace.viewer","workspace.member","workspace.admin"],"description":"User's role within the workspace","example":"workspace.member"},"ServiceAccountSubject":{"type":"object","properties":{"kind":{"type":"string","enum":["serviceAccount"],"description":"Subject type identifier"},"id":{"type":"string","description":"Unique service account identifier (API key ID)"},"workspaceId":{"type":"string","description":"ID of the workspace the service account belongs to"},"workspaceName":{"type":"string","description":"Name of the workspace the service account belongs to"},"scope":{"$ref":"#/components/schemas/SubjectScope"},"role":{"$ref":"#/components/schemas/Role"}},"required":["kind","id","workspaceId","scope","role"],"description":"Authenticated service account subject with scoped permissions (workspace, project, or deployment level)"},"SubjectScope":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["workspace"],"description":"Workspace-scoped access"}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["project"],"description":"Project-scoped access"},"projectId":{"type":"string","description":"ID of the specific project this scope applies to"}},"required":["type","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment"],"description":"Deployment-scoped access"},"deploymentId":{"type":"string","description":"ID of the specific deployment this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"}},"required":["type","deploymentId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"],"description":"Deployment group-scoped access"},"deploymentGroupId":{"type":"string","description":"ID of the specific deployment group this scope applies to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"}},"required":["type","deploymentGroupId","projectId"]},{"type":"object","properties":{"type":{"type":"string","enum":["manager"],"description":"Manager-scoped access"},"managerId":{"type":"string","description":"ID of the specific manager this scope applies to"}},"required":["type","managerId"]}],"description":"Authorization scope defining what resources this service account can access"},"Role":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"$ref":"#/components/schemas/ProjectRole"},{"$ref":"#/components/schemas/DeploymentRole"},{"$ref":"#/components/schemas/DeploymentGroupRole"},{"$ref":"#/components/schemas/ManagerRole"}],"description":"Role defining what actions this service account can perform within its scope","example":"workspace.member"},"ProjectRole":{"type":"string","enum":["project.viewer","project.developer","project.encryption","project.ai-gateway","project.sandbox-gateway","project.remote-bindings"],"description":"Role for project-scoped service accounts","example":"project.developer"},"DeploymentRole":{"type":"string","enum":["deployment.viewer","deployment.manager","deployment.dynamic-container-manager","deployment.telemetry-writer"],"description":"Role for deployment-scoped service accounts","example":"deployment.manager"},"DeploymentGroupRole":{"type":"string","enum":["deployment-group.deployer"],"description":"Role for deployment group-scoped service accounts","example":"deployment-group.deployer"},"ManagerRole":{"type":"string","enum":["manager.runtime"],"description":"Role for manager-scoped service accounts","example":"manager.runtime"},"ProjectIDOrNamePathParam":{"type":"string","maxLength":100,"description":"Project ID or name."},"Workspace":{"type":"object","properties":{"id":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name.","example":"my-workspace"},"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","createdAt"],"additionalProperties":false},"WorkspaceMember":{"type":"object","properties":{"userId":{"type":"string"},"email":{"type":"string"},"name":{"type":"string"},"image":{"type":"string","nullable":true},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"joinedAt":{"type":"string","format":"date-time"}},"required":["userId","email","name","image","role","joinedAt"],"additionalProperties":false},"AgentSettings":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"enabled":{"type":"boolean","description":"Workspace on/off switch for the ai-agent. When `false`, incoming triggers (release/deployment monitoring and Slack-invoked sessions) are rejected before any session runs. Defaults to `true`."},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","enabled","createdAt","updatedAt"],"additionalProperties":false},"UpdateWorkspaceSettingsRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Turn the ai-agent on (`true`) or off (`false`) for this workspace."}}},"WorkspaceInvitation":{"type":"object","properties":{"id":{"type":"string","pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"},"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"status":{"type":"string","enum":["pending","accepted","revoked","expired"]},"deliveryStatus":{"type":"string","enum":["pending","sent","failed"]},"expiresAt":{"type":"string","format":"date-time"},"lastSentAt":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","email","role","status","deliveryStatus","expiresAt","lastSentAt","createdAt","inviteUrl"],"additionalProperties":false},"WorkspaceInviteLink":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"wil_[0-9a-zA-Z]{40}$","description":"Unique identifier for the workspace invite link.","example":"wil_RgcthDSZ37rmFLekuItpFS7btjXoYwou1gE4"},"role":{"$ref":"#/components/schemas/WorkspaceRole"},"expiresAt":{"type":"string","format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"useCount":{"type":"integer","minimum":0},"lastUsedAt":{"type":"string","format":"date-time","nullable":true},"inviteUrl":{"type":"string","format":"uri"}},"required":["id","role","expiresAt","createdAt","useCount","lastUsedAt","inviteUrl"],"additionalProperties":false},"ProjectListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"deploymentCount":{"type":"number"},"latestRelease":{"$ref":"#/components/schemas/ProjectReleaseInfo"}}}]},"DeploymentPortalAppearancePreset":{"type":"string","enum":["clean","technical","enterprise","playful","minimal"],"default":"clean","description":"Curated visual style for the deployment portal."},"DeploymentPortalAccentColor":{"type":"string","enum":["blue","purple","green","orange","pink","slate"],"default":"blue","description":"Accent color used for highlights and primary actions."},"DeploymentPortalDensity":{"type":"string","enum":["comfortable","compact"],"default":"comfortable","description":"Layout density for portal content."},"ProjectReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","gitMetadata","createdAt"]},"GitMetadata":{"type":"object","nullable":true,"properties":{"commitSha":{"type":"string","nullable":true,"pattern":"^(?:[0-9a-fA-F]{40}|[0-9a-fA-F]{64})$","description":"The hash of the commit","example":"dc36199b2234c6586ebe05ec94078a895c707e29"},"commitMessage":{"type":"string","nullable":true,"maxLength":1024,"description":"The commit message","example":"add method to measure Interaction to Next Paint (INP) (#36490)"},"commitRef":{"type":"string","nullable":true,"maxLength":256,"description":"The branch or tag on which the commit was made","example":"main"},"commitDate":{"type":"string","nullable":true,"format":"date-time","description":"The date and time when the commit was created","example":"2026-03-16T12:00:00Z"},"dirty":{"type":"boolean","nullable":true,"description":"Whether or not there have been modifications to the working tree since the latest commit","example":true},"remoteUrl":{"type":"string","nullable":true,"maxLength":2048,"description":"The git repository's remote origin url","example":"https://github.com/alienplatform/alien"},"commitAuthorName":{"type":"string","nullable":true,"maxLength":256,"description":"The name of the author of the commit (from git config)","example":"John Doe"},"commitAuthorEmail":{"type":"string","nullable":true,"maxLength":256,"description":"The author identity recorded by Git. This is not guaranteed to be an RFC-valid email address.","example":"john@example.com"},"commitAuthorLogin":{"type":"string","nullable":true,"maxLength":256,"description":"The provider username of the commit author (e.g., GitHub login), resolved server-side from the commit email","example":"johndoe"},"commitAuthorAvatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"The avatar URL of the commit author, resolved server-side from the provider login","example":"https://github.com/johndoe.png"},"provider":{"$ref":"#/components/schemas/GitProvider"}}},"GitProvider":{"oneOf":[{"$ref":"#/components/schemas/GitHubProvider"},{"$ref":"#/components/schemas/GitLabProvider"},{"nullable":true}],"description":"Provider-specific repository information, resolved server-side from remoteUrl"},"GitHubProvider":{"type":"object","properties":{"type":{"type":"string","enum":["github"]},"org":{"type":"string","maxLength":256,"description":"Repository owner (user or organization)"},"repo":{"type":"string","maxLength":256,"description":"Repository name"}},"required":["type","org","repo"]},"GitLabProvider":{"type":"object","properties":{"type":{"type":"string","enum":["gitlab"]},"namespace":{"type":"string","maxLength":256,"description":"Group/project namespace"},"project":{"type":"string","maxLength":256,"description":"Project name"}},"required":["type","namespace","project"]},"Project":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"projectCapabilities":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"default":null,"required":["schemaVersion","capabilities"],"additionalProperties":false,"description":"Capabilities this Project may offer through setup links."},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","createdAt","workspaceId"]},"ProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","redirectUris"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"hasClientSecret":{"type":"boolean","enum":[true]},"redirectUris":{"type":"array","items":{"type":"string","format":"uri"},"description":"Authorized redirect URIs that must be configured on the Google OAuth client."}},"required":["mode","clientId","hasClientSecret","redirectUris"]}]},"GcpOAuthClientId":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[a-zA-Z0-9_-]+-[a-zA-Z0-9_-]+\\.apps\\.googleusercontent\\.com$","description":"Google OAuth web client ID.","example":"1234567890-abc123.apps.googleusercontent.com"},"UpdateProjectGcpOAuthProvider":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId"]}]},"GcpOAuthClientSecret":{"type":"string","minLength":1,"maxLength":512,"description":"Google OAuth web client secret. Write-only; never returned by the API.","example":"GOCSPX-example"},"UpdateProject":{"type":"object","properties":{"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"deploymentPortalAppearance":{"type":"object","nullable":true,"properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}},"description":"Customer-facing deployment portal appearance settings."},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Selected domain for this project (null = default system domain)","example":"dom_469m0agk8luj4s16sakmmpdd"},"defaultManagers":{"type":"object","nullable":true,"properties":{"aws":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"gcp":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"azure":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"kubernetes":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"machines":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"local":{"type":"string","nullable":true,"pattern":"mgr_[0-9a-z]{28}$","description":"Unique identifier for a default private manager.","example":"mgr_enxscjrqiiu2lrc672hwwuc5"}},"description":"Project default private managers for new push deployments."},"packagesConfigPatch":{"type":"object","properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"additionalProperties":false},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"additionalProperties":false},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"additionalProperties":false},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"additionalProperties":false},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","nullable":true,"properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"additionalProperties":false}},"additionalProperties":false}},"additionalProperties":false}}},"DeploymentPortalDomainResponse":{"type":"object","properties":{"deploymentPortalEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"},"packageEndpoint":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["deploymentPortalEndpoint","packageEndpoint"]},"DomainEndpoint":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dend_[0-9a-z]{28}$","description":"Unique identifier for the domain endpoint.","example":"dend_1bb6gdvm1bs74acqkjstcgv"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domainId":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"kind":{"$ref":"#/components/schemas/DomainEndpointKind"},"owner":{"$ref":"#/components/schemas/DomainEndpointOwner"},"hostname":{"type":"string","minLength":1,"maxLength":253},"status":{"$ref":"#/components/schemas/DomainEndpointStatus"},"provider":{"type":"string","nullable":true},"providerState":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"managedDnsRecords":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentPortalManagedDnsRecord"}},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"retryAttempts":{"type":"integer","minimum":0},"nextStepAfter":{"type":"string","format":"date-time","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","workspaceId","domainId","kind","owner","hostname","status","managedDnsRecords","retryAttempts","createdAt","updatedAt"]},"DomainEndpointKind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"DomainEndpointOwner":{"type":"object","properties":{"type":{"$ref":"#/components/schemas/DomainEndpointOwnerType"},"id":{"type":"string"}},"required":["type","id"]},"DomainEndpointOwnerType":{"type":"string","enum":["workspace","project","manager"]},"DomainEndpointStatus":{"type":"string","enum":["waiting_for_domain","provisioning","waiting_for_dns","waiting_for_health","active","failed","deleting"]},"DeploymentPortalManagedDnsRecord":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string"},"value":{"type":"string"},"ttl":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true}},"required":["name","type","value"]},"DeploymentLinkSetupResponse":{"type":"object","properties":{"activeRelease":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","nullable":true},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true}},"required":["id","version","stack"]},"supportedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"setupItems":{"type":"array","items":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]}},"visiblePackageTypes":{"type":"array","items":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"}},"visibleSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"setupPackagesStatus":{"type":"string","enum":["preparing","ready","failed"],"description":"Whether at least one complete automated setup package is ready across all selected setup items."}},"required":["activeRelease","supportedPlatforms","setupItems","visiblePackageTypes","visibleSetupMethods","setupPackagesStatus"]},"StackByPlatform":{"type":"object","properties":{"aws":{"nullable":true},"gcp":{"nullable":true},"azure":{"nullable":true},"kubernetes":{"nullable":true},"machines":{"nullable":true},"local":{"nullable":true},"test":{"nullable":true}},"additionalProperties":false},"DeploymentSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform","helm","cli","manual"]},"ConfigureModelsRequest":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"minItems":1,"maxItems":100}},"required":["requirements"],"additionalProperties":false},"ProjectCapabilities":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"capabilities":{"type":"object","properties":{"deployments":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled"],"additionalProperties":false},"keys":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["enabled","applicationEncryption"],"additionalProperties":false},"models":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"requirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"required":["enabled","allowedProviders","requirements"],"additionalProperties":false},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"access":{"type":"string","enum":["read-write"]}},"required":["enabled","access"],"additionalProperties":false},"registry":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["enabled","repositories","credentialPolicy"],"additionalProperties":false},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"baseImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"azure":{"type":"object","properties":{"registryImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"idleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"required":["idleSuspendSeconds"],"additionalProperties":false},"gcp":{"type":"object","properties":{"image":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["maxLifetimeSeconds"],"additionalProperties":false},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800}},"required":["enabled"],"additionalProperties":false}},"additionalProperties":false}},"required":["schemaVersion","capabilities"],"additionalProperties":false},"AIProviderHeaders":{"type":"object","properties":{"providers":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"headers":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"},"value":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7E]*$"}},"required":["name","value"],"additionalProperties":false},"minItems":1,"maxItems":20}},"required":["provider","headers"],"additionalProperties":false},"maxItems":6}},"required":["providers"],"additionalProperties":false},"CapabilityMaterialization":{"type":"object","properties":{"projectCapabilities":{"$ref":"#/components/schemas/ProjectCapabilities"},"source":{"type":"object","properties":{"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"definitionVersion":{"type":"string"},"releaseId":{"type":"string"}},"required":["definitionId","definitionVersion","releaseId"]},"packages":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation","terraform","sandbox-bundle","gcp-sandbox-image"]},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"]}},"required":["type","status"]}}},"required":["projectCapabilities","source","packages"]},"ConfigureRemoteSandboxRequest":{"type":"object","properties":{"customImage":{"type":"string","minLength":1,"maxLength":1024,"pattern":"^[!-~]+$"},"maxLifetimeSeconds":{"type":"integer","minimum":1,"maximum":28800},"azureIdleSuspendSeconds":{"type":"integer","minimum":1,"maximum":86400}},"additionalProperties":false},"SandboxBaseImageRepository":{"type":"object","properties":{"registryHost":{"type":"string","description":"Manager registry host to `docker login` to and push through."},"repository":{"type":"string","description":"This project's repository under that host."}},"required":["registryHost","repository"]},"ProjectCapabilityOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"configurationStatus":{"type":"string","enum":["valid","invalid"]},"hasAppRemoteSandbox":{"type":"boolean"},"summary":{"type":"object","properties":{"groups":{"type":"integer","minimum":0},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"keys":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"buckets":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"registry":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]},"remoteSandbox":{"type":"object","properties":{"enabled":{"type":"boolean"},"connected":{"type":"integer","minimum":0},"settingUp":{"type":"integer","minimum":0},"needsAttention":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"notConnected":{"type":"integer","minimum":0}},"required":["enabled","connected","settingUp","needsAttention","revoked","notConnected"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["groups","capabilities"]},"groups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"capabilities":{"type":"object","properties":{"models":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"keys":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"buckets":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"registry":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]},"remoteSandbox":{"type":"object","properties":{"capability":{"type":"string","enum":["models","keys","buckets","registry","remoteSandbox"]},"enabled":{"type":"boolean"},"state":{"type":"string","enum":["not-connected","setting-up","connected","needs-attention","revoked"]},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"source":{"type":"string","enum":["capability","app"]},"sandboxUpdate":{"type":"string","enum":["up-to-date","behind","blocked","update-failed","bundle-failed","platform-removed"]},"observation":{"type":"object","nullable":true,"properties":{"provider":{"type":"string","nullable":true},"platform":{"type":"string","nullable":true,"enum":["aws","gcp","azure","local","kubernetes","machines","test",null]},"resourceId":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"account":{"type":"string","nullable":true},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"},"partial":{"type":"boolean"},"health":{"type":"string","nullable":true,"enum":["unknown","healthy","degraded","unhealthy",null]},"lifecycle":{"type":"string","nullable":true},"message":{"type":"string","nullable":true}},"required":["provider","platform","resourceId","location","account","observedAt","stale","partial","health","lifecycle","message"]},"modelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"required":{"type":"boolean"},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockerCodes":{"type":"array","items":{"type":"string"}},"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","required","availability","blockerCodes","accessTest","accessObservedAt"]}},"directProvider":{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["provider","providerEndpoint","keyFingerprint","credentialStatus","credentialCheckedAt","catalogObservedAt"]},"root":{"type":"object","properties":{"state":{"type":"string","enum":["pending","ready","revoked"]},"createdAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["state","createdAt"]},"registry":{"type":"object","properties":{"repositories":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull","mixed","none"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["repositories","credentials","credentialPolicy","lastVerifiedAt"]}},"required":["capability","enabled","state","deploymentId","observation"]}},"required":["models","keys","buckets","registry","remoteSandbox"]}},"required":["deploymentGroupId","name","externalId","createdAt","capabilities"]}}},"required":["generatedAt","configurationStatus","hasAppRemoteSandbox","summary","groups"]},"RemoteBindingsExternalAccessResponse":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1},"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","format":"uri"}},"required":["deploymentId","resourceId","accessToken","expiresIn","tokenType","managerUrl"]},"RemoteBindingsExternalAccessRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"capability":{"type":"string","enum":["storage","sandbox"]}},"required":["externalId","capability"],"additionalProperties":false},"RemoteOperatorInstallReceipt":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"renderedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","renderedAt"],"additionalProperties":false},"ObservedRemoteOperatorImageIdentity":{"type":"object","nullable":true,"properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"observedAt":{"type":"string","format":"date-time"}},"required":["source","packageId","packageVersion","image","digest","observedAt"],"additionalProperties":false},"OperationsCatalogKubernetesPermissions":{"type":"object","nullable":true,"properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsRule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false,"description":"Kubernetes RBAC required to execute this operation. Omitted by older servers and null when the operation declares none."},"OperationsCatalogKubernetesPermissionsRule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissionsVerb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"OperationsCatalogKubernetesPermissionsVerb":{"type":"string","enum":["get","list","watch","delete","patch"]},"RemoteOperatorPermissionPlugin":{"type":"object","properties":{"name":{"type":"string"},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"permissions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["aws","gcp"]},"kubernetesPermissions":{"type":"object","nullable":true,"properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"}},"reason":{"type":"string"}},"required":["apiGroup","resource","verbs","reason"]}}},"required":["rules"]}},"required":["name","permissions"]}}},"required":["name","operations"]},"DeploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments allowed in this deployment group"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","name","externalId","projectId","workspaceId","createdAt"]},"CreateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments in this deployment group"}},"required":["name","project"]},"EnsureDeploymentGroupByNameRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["name","project"]},"EnsureDeploymentGroupByExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"project":{"type":"string","maxLength":100,"description":"Project ID or name this deployment group belongs to"},"maxDeployments":{"type":"integer","minimum":1,"default":100,"description":"Maximum number of deployments for newly created groups"}},"required":["externalId","name","project"]},"CreateSetupLinkResponse":{"allOf":[{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"},{"type":"object","properties":{"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroup"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"The persisted expiration date for the setup link"}},"required":["deploymentGroup","expiresAt"]}]},"CreateDeploymentGroupTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The API key token"},"deploymentLink":{"type":"string","description":"Formatted deployment link"}},"required":["token","deploymentLink"]},"CreateSetupLinkRequest":{"allOf":[{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"},{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"recoveryDeploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Recover Remote Operator bootstrap values for this exact existing group only if it has no deployments. Serialized with registration; never creates or rebinds a group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"}}}]},"DeploymentSetupConfigInput":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}}},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."}}},"DeploymentSetupMetadata":{"type":"object","additionalProperties":{"nullable":true}},"KubernetesClusterSource":{"type":"string","enum":["create","existing"]},"DeploymentSetupStackSettingsPolicy":{"type":"object","properties":{"defaults":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"allowedDeploymentModels":{"type":"array","items":{"type":"string","enum":["push","pull","airgapped"]}},"allowedNetworkModes":{"type":"array","items":{"type":"string","enum":["none","create","default","byo"]}},"allowedUpdatesModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required"]}},"allowedTelemetryModes":{"type":"array","items":{"type":"string","enum":["auto","approval-required","off"]}},"allowedHeartbeatsModes":{"type":"array","items":{"type":"string","enum":["on","off"]}},"allowExternalBindings":{"type":"boolean"},"allowCustomRegistry":{"type":"boolean"}}},"EnvironmentVariableConfig":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"value":{"type":"string","maxLength":10000,"description":"Variable value (encrypted in database)"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","value","type","targetResources"]},"EnvironmentVariableType":{"type":"string","enum":["plain","secret"],"description":"Variable type (plain or secret)"},"DeploymentSetupItemSelection":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":{"type":"boolean"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"Deprecated request shorthand. Use deploymentSetupConfig.policy.allowedAIProviders."}},"required":["item","required"],"additionalProperties":false},"SetupLinkEntryPoint":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"provider":{"oneOf":[{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},{"type":"string","enum":["aws","gcp","azure"]}]}},"required":["item"],"additionalProperties":false,"description":"Portal destination to open first. This controls navigation, not authorization."},"StackInputValuesRequest":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{}},"StackInputValueRequest":{"oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"type":"string"}}]},"ProjectIDOrNameQueryParam":{"type":"string","maxLength":100,"description":"Filter by project ID or name."},"SetDeploymentGroupExternalIdRequest":{"type":"object","properties":{"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"]},"UpdateDeploymentGroupRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"maxDeployments":{"type":"integer","minimum":1,"description":"Maximum number of deployments in this deployment group"}}},"CreateDeploymentGroupTokenRequest":{"type":"object","properties":{"description":{"type":"string","description":"Description for the API key"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"},"deploymentSetupConfig":{"$ref":"#/components/schemas/DeploymentSetupConfigInput"},"setupItems":{"oneOf":[{"type":"string","enum":["all"]},{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupItemSelection"},"maxItems":8}],"description":"Setup to include. Use 'all' for every capability enabled for the Project. Omit to preserve the standard deployment-link behavior."},"entryPoint":{"$ref":"#/components/schemas/SetupLinkEntryPoint"},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}}},"CreateFirstPartyDeploymentSessionResponse":{"type":"object","properties":{"token":{"type":"string","description":"The deployment-group session token"}},"required":["token"]},"ExternalAIBindingState":{"type":"object","properties":{"binding":{"$ref":"#/components/schemas/ExternalAIBinding"}},"required":["binding"]},"ExternalAIBinding":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"provider":{"type":"string","enum":["anthropic","databricks","openai"]},"providerEndpoint":{"type":"string","nullable":true},"providerClientId":{"type":"string","nullable":true},"keyFingerprint":{"type":"string"},"credentialRevision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"credentialStatus":{"type":"string","enum":["pending","valid","invalid","unknown"]},"credentialCheckedAt":{"type":"string","nullable":true,"format":"date-time"},"catalogProviderModelIds":{"type":"array","nullable":true,"items":{"type":"string"}},"catalogObservedAt":{"type":"string","nullable":true,"format":"date-time"},"requiredModelCoverage":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string"},"available":{"type":"boolean","nullable":true},"accessStatus":{"type":"string","nullable":true,"enum":["verified","denied",null]},"accessObservedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["publicModelId","available","accessStatus","accessObservedAt"]}},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","provider","providerEndpoint","providerClientId","keyFingerprint","credentialRevision","credentialStatus","credentialCheckedAt","catalogProviderModelIds","catalogObservedAt","requiredModelCoverage","updatedAt"]},"PutExternalAIBindingRequest":{"oneOf":[{"type":"object","properties":{"provider":{"type":"string","enum":["anthropic","openai"]},"apiKey":{"type":"string","minLength":1,"maxLength":512},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","apiKey","acknowledgeAlienCredentialAccess"],"additionalProperties":false},{"type":"object","properties":{"provider":{"type":"string","enum":["databricks"]},"workspaceUrl":{"type":"string","minLength":1,"maxLength":512},"clientId":{"type":"string","minLength":1,"maxLength":512},"clientSecret":{"type":"string","minLength":1,"maxLength":4096},"acknowledgeAlienCredentialAccess":{"type":"boolean","enum":[true]}},"required":["provider","workspaceUrl","clientId","clientSecret","acknowledgeAlienCredentialAccess"],"additionalProperties":false}]},"ExternalAIModelCheck":{"type":"object","properties":{"id":{"type":"string"},"publicModel":{"type":"string"},"status":{"type":"string","enum":["pending","running","verified","denied","failed","cancelled"]},"blockerCode":{"type":"string","nullable":true},"error":{"nullable":true},"requestedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","publicModel","status","blockerCode","requestedAt","completedAt"]},"ContainerRegistryState":{"type":"object","properties":{"route":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]},"endpoint":{"type":"object","nullable":true,"properties":{"url":{"type":"string","format":"uri"},"source":{"type":"string","enum":["runtime","custom-domain"]}},"required":["url","source"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]}}},"required":["route","endpoint","repositories","credentials"]},"CreateContainerRegistryCredentialResponse":{"type":"object","properties":{"credential":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"label":{"type":"string"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","label","scope","repositorySubset","expiresAt","lastUsedAt","revokedAt","createdAt"]},"username":{"type":"string","enum":["alien"]},"password":{"type":"string"}},"required":["credential","username","password"]},"Package":{"type":"object","properties":{"id":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"type":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Types of packages that can be built"},"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string","description":"Package version (e.g., '1.0.0', 'rel_abc123')"},"sourceReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release used as package build input. Null for release-less packages such as Operate Operator images.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"dependsOnPackageId":{"type":"string","nullable":true,"pattern":"pkg_[0-9a-z]{28}$","description":"Exact package dependency used as build input. Helm packages use this to identify the Operator image embedded in the chart.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"setupFingerprints":{"$ref":"#/components/schemas/SetupFingerprintMap"},"packageBuildInputHash":{"type":"string","description":"Hash of Platform-known package build request inputs: package type, source release, setup fingerprints, package config, and setup contract version"},"config":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"}},"required":["displayName","name"],"description":"Branding configuration for the deploy CLI binary."},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package paired with managed Kubernetes setup artifacts.\n\nThis is derived by the platform and is independent from the generic dependency, which\ncan point at a sandbox bundle for a mixed AWS and Kubernetes release."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for CloudFormation packages"},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image the agent binary is read from."},"baseImage":{"type":"string","description":"`custom_image` resolved to its linux/amd64 manifest, `registry/repository@sha256:...`."},"customImage":{"type":"string","description":"The developer's image as typed, which ties the package to the capability that asked."},"managerUrl":{"type":"string","description":"URL of the GCP manager whose registry proxy receives the push."}},"required":["agentImage","baseImage","customImage","managerUrl"],"description":"Configuration for a GCP sandbox image package.\n\nThe image is the developer's base with the sandbox agent and its contract layered on, pushed\ninto the project's path of the GCP manager's registry."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"managerUrl":{"type":"string","description":"Resolved default management endpoint captured when this build was queued."},"operationPermissions":{"type":"array","nullable":true,"items":{"type":"object","properties":{"operation":{"type":"string","description":"Operation name within the plugin."},"permissions":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Kubernetes API group. An empty string denotes the core API."},"reason":{"type":"string","description":"Human-readable reason the operation requires this rule."},"resource":{"type":"string","description":"Plural Kubernetes resource, optionally with a supported subresource."},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Optional concrete resource names. Empty means all names in the installation scope."},"verbs":{"type":"array","items":{"type":"string"},"description":"Concrete Kubernetes API verbs required by the operation."}},"required":["apiGroup","reason","resource","verbs"],"description":"One Kubernetes API requirement declared by an enabled operation."},"description":"Explicit Kubernetes API requirements."},"schemaVersion":{"type":"integer","minimum":0,"description":"Schema version of the validated permission declaration."}},"required":["rules","schemaVersion"],"description":"Versioned Kubernetes API requirements declared by an enabled operation."},"plugin":{"type":"string","description":"Operations plugin name."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier of an enabled operation in a Helm build snapshot."}},"required":["operation","permissions","plugin","tier"],"description":"Canonical Kubernetes permission snapshot for one enabled operation."},"description":"Canonical Kubernetes permissions for the operations enabled when this build was queued.\n\nThis is derived by the platform and persisted with the build request. It is not part of\nthe user-authored project package configuration. `None` identifies an older package row\nthat must be re-enqueued; an empty `Some` is a reviewed snapshot with no extra grants."},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","description":"Existing namespace claim instead of creating a new claim."},"size":{"type":"string","description":"Requested claim capacity, for example 1Gi."},"storageClassName":{"type":"string","description":"Cluster storage class; empty uses the cluster default."}},"required":["enabled","existingClaim","size","storageClassName"],"description":"Operator identity storage in the generated chart. This does not install a storage driver."},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","description":"Data key inside the Secret."},"name":{"type":"string","description":"Fixed Kubernetes Secret name expected by the workload's Secret mount."},"prefix":{"type":"string","description":"Plaintext prefix before the random alphanumeric suffix."},"randomLength":{"type":"integer","minimum":0,"description":"Length of the random suffix."}},"required":["key","name","prefix","randomLength"],"description":"Non-secret configuration for a chart-generated enrollment token."},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","description":"Empty string for the core Kubernetes API group."},"resources":{"type":"array","items":{"type":"string"},"description":"Kubernetes plural resource names; wildcards are not accepted."}},"required":["apiGroup","resources"],"description":"Resource family the chart grants get/list/watch over."},"description":"Exact API groups and resources. Verbs are fixed to get/list/watch."},"serviceAccountProfile":{"type":"string","description":"Permission profile used by the workload Container and generated ServiceAccount."}},"required":["rules","serviceAccountProfile"],"description":"Cluster reads granted to a workload identity, separate from Operator permissions."}},"required":["tokenSecret","workloadReadAccess"],"description":"Kubernetes resources created by the product chart before the runtime starts."}},"required":["chartName","description"],"description":"Configuration for the Helm chart package"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"}},"required":["displayName","name"],"description":"Branding configuration for the Operator image."},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentImage":{"type":"string","description":"Full reference of the published sandbox agent image copied into the bundle."},"baseImage":{"type":"string","description":"The base container image the sandbox filesystem starts from. A release-pushed image\narrives resolved onto the private registry template with its {region} token intact."},"objectKey":{"type":"string","description":"Object key the bundle is written under in every regional bundle store."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store must receive this bundle. Part of the build input hash,\nso a newly supported region re-mints the bundle instead of silently missing it."}},"required":["agentImage","baseImage","objectKey"],"description":"Configuration for a sandbox bundle package.\n\nThe bundle is a zip holding one Dockerfile that layers the published Alien sandbox agent\nonto the vendor's base image; everything the builder writes is derived from these fields."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts."},"helmPackageId":{"type":"string","nullable":true,"description":"Exact Helm package used to compose managed Kubernetes modules.\n\nThis is derived by the platform and persisted with the build request. It is separate\nfrom the generic package dependency because a mixed AWS and Kubernetes release can also\ndepend on a sandbox bundle."},"supportedAwsRegions":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by the environment that built this package."}},"description":"Configuration for Terraform package generation."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]}],"description":"Type-specific configuration"},"outputs":{"oneOf":[{"allOf":[{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},{"type":"object","properties":{"type":{"type":"string","enum":["cli"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"digest":{"type":"string","description":"Image digest (e.g., \"sha256:abc123...\")"},"image":{"type":"string","description":"Full image reference (e.g., \"public.ecr.aws/acme/operators/project-id:1.2.3\")"},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain packaged into the Operator image, if whitelabeled."}},"required":["digest","image"],"description":"Outputs from an Operator image package build"},{"type":"object","properties":{"type":{"type":"string","enum":["operator-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},{"type":"object","properties":{"type":{"type":"string","enum":["helm"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},{"type":"object","properties":{"type":{"type":"string","enum":["cloudformation"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"agentDigest":{"type":"string","description":"Manifest digest of the linux/amd64 agent image the agent binary came from."},"baseDigest":{"type":"string","description":"Manifest digest of the linux/amd64 base the image was built from."},"digest":{"type":"string","description":"Manifest digest of the pushed image."},"image":{"type":"string","description":"Native registry reference pinned by digest, the value a GCP sandbox stack names."},"reuseKey":{"type":"string","description":"Hash of the base digest, the agent image reference and the image contract; equal keys reuse."}},"required":["agentDigest","baseDigest","digest","image","reuseKey"],"description":"Outputs from a GCP sandbox image package build."},{"type":"object","properties":{"type":{"type":"string","enum":["gcp-sandbox-image"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"bundleUriTemplate":{"type":"string","description":"Bundle URI with the {region} token in the bucket, resolved by the deploy-time emitters."},"objectKey":{"type":"string","description":"Object key the bundle was written under in every regional bundle store."},"regions":{"type":"array","items":{"type":"string"},"description":"Regions whose bundle store received this bundle."},"sha256":{"type":"string","description":"SHA256 checksum of the region-neutral bundle zip; a region-templated base image makes\neach regional object differ from it only in the rendered region."},"size":{"type":"integer","minimum":0,"description":"Region-neutral bundle zip size in bytes."}},"required":["bundleUriTemplate","objectKey","regions","sha256","size"],"description":"Outputs from a sandbox bundle package build."},{"type":"object","properties":{"type":{"type":"string","enum":["sandbox-bundle"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},{"type":"object","properties":{"type":{"type":"string","enum":["terraform"]}},"required":["type"]}]},{"nullable":true}],"description":"Package outputs (only when status is 'ready')"},"error":{"nullable":true,"description":"Error information if status is 'failed'"},"sourceBinarySha256":{"type":"string","nullable":true,"description":"Builder-recorded source binary SHA256 (for cli/terraform packages)"},"retries":{"type":"integer","minimum":0,"description":"Number of build retries"},"lockedAt":{"type":"string","format":"date-time","nullable":true},"lockedBy":{"type":"string","nullable":true},"leaseExpiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Expiration of the current builder lease"},"buildPhase":{"type":"string","nullable":true,"enum":["building","publishing",null],"description":"Coarse package build phase"},"lastProgressAt":{"type":"string","format":"date-time","nullable":true,"description":"Last successful builder lease renewal or phase change"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","projectId","workspaceId","type","status","version","setupFingerprints","packageBuildInputHash","config","retries","createdAt","updatedAt"]},"SetupFingerprintMap":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/SetupFingerprintInfo"},"description":"Per-target setup compatibility fingerprints copied from the source release"},"SetupFingerprintInfo":{"type":"object","properties":{"target":{"$ref":"#/components/schemas/SetupTarget"},"fingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"version":{"$ref":"#/components/schemas/SetupFingerprintVersion"}},"required":["target","fingerprint","version"]},"SetupTarget":{"type":"string","minLength":1,"description":"Stable target key for the setup contract, e.g. aws/us-east-1"},"SetupFingerprint":{"type":"string","minLength":1,"description":"Deterministic setup contract fingerprint for one setup target"},"SetupFingerprintVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup fingerprint algorithm version"},"ReleaseListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Release"},{"type":"object","properties":{"currentChannels":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannelName"},"description":"Channels for which this release is currently selected"},"commitUrl":{"type":"string","nullable":true,"format":"uri","description":"Validated canonical provider URL for the exact commit"},"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"rollout":{"type":"object","nullable":true,"properties":{"updatedCount":{"type":"integer","description":"Deployments that finished updating to this release (excludes initial provisions)"},"pendingCount":{"type":"integer","description":"Deployments currently targeting this release but not yet running it"},"avgDurationMs":{"type":"number","nullable":true,"description":"Average time from release creation until a deployment finished updating, in milliseconds"}},"required":["updatedCount","pendingCount","avgDurationMs"],"description":"Rollout stats, included when ?include=rollout is used"},"createdBy":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"User ID"},"name":{"type":"string","description":"User's display name"},"email":{"type":"string","description":"User's email address"},"image":{"type":"string","nullable":true,"description":"User's avatar image URL"}},"required":["id","name","email","image"],"description":"Platform user who created the release, included when ?include=createdBy is used"}},"required":["currentChannels","commitUrl"]}]},"ReleaseChannelName":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$"},"Release":{"type":"object","properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"projectId":{"type":"string","maxLength":128},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"},"stack":{"allOf":[{"$ref":"#/components/schemas/StackByPlatform"}],"nullable":true},"setupFingerprints":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintMap"},{"description":"Per-target setup compatibility fingerprints for this release"}]},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"createdByUserId":{"type":"string","nullable":true,"maxLength":128,"description":"ID of the platform user who created the release, if known"},"workspaceId":{"type":"string","maxLength":128}},"required":["id","projectId","version","createdAt","setupFingerprints","workspaceId"]},"CreateReleaseRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"version":{"type":"string","minLength":1,"maxLength":256},"title":{"type":"string","nullable":true,"minLength":1,"maxLength":256,"description":"Human-readable release title"},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"stack":{"$ref":"#/components/schemas/StackByPlatform"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256},"channel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Release channel to advance. Defaults to production."}]}},"required":["project"]},"ReleaseAuthorFilterItem":{"type":"object","properties":{"login":{"type":"string","nullable":true,"description":"Provider username (e.g., GitHub login)"},"name":{"type":"string","nullable":true,"description":"Git commit author name"},"avatarUrl":{"type":"string","nullable":true,"format":"uri","description":"Author avatar URL"}},"required":["login","name","avatarUrl"]},"ReleaseDeploymentsResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseDeploymentItem"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"},"stateCounts":{"$ref":"#/components/schemas/ReleaseRolloutStateCounts"}},"required":["items","nextCursor","stateCounts"]},"ReleaseDeploymentItem":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"deploymentGroup":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"],"description":"Deployment group this deployment belongs to"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"rolloutState":{"$ref":"#/components/schemas/ReleaseRolloutState"},"releasedAt":{"type":"string","format":"date-time","nullable":true,"description":"When this release went live on the deployment, null if it never did"},"durationMs":{"type":"integer","nullable":true,"description":"Time from release creation until the deployment finished updating, in milliseconds. Null for initial provisions and deployments that never ran this release."},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"}},"required":["id","name","status","platform","rolloutState","releasedAt","durationMs"]},"ReleaseRolloutState":{"type":"string","enum":["updated","updating","failed","pending","pinned-other","superseded","on-other"]},"ReleaseRolloutStateCounts":{"type":"object","properties":{"updated":{"type":"integer"},"updating":{"type":"integer"},"failed":{"type":"integer"},"pending":{"type":"integer"},"pinned-other":{"type":"integer"},"superseded":{"type":"integer"},"on-other":{"type":"integer"}},"required":["updated","updating","failed","pending","pinned-other","superseded","on-other"],"description":"Deployment counts per rollout state across all deployments the filters allow (ignores the state filter)"},"ReleaseChannel":{"type":"object","properties":{"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"deploymentCount":{"type":"integer","minimum":0},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["workspaceId","projectId","name","currentReleaseId","createdAt","updatedAt"]},"DeploymentListItemResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if in a failed state"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"$ref":"#/components/schemas/ManagerID"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentProtocolVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"DeploymentState protocol version owned by the runtime/manager"},"DeploymentPurpose":{"type":"string","enum":["application","encryption","ai","storage","container-registry","sandbox"],"description":"Operational purpose of this deployment within its customer environment."},"OperatorCapabilityReport":{"type":"object","properties":{"key":{"type":"string","minLength":1,"maxLength":128},"state":{"$ref":"#/components/schemas/OperatorCapabilityState"},"detail":{"type":"string","nullable":true,"maxLength":512}},"required":["key","state"]},"OperatorCapabilityState":{"type":"string","enum":["granted","denied","unavailable"]},"ManagerID":{"type":"string","pattern":"mgr_[0-9a-z]{28}$","description":"ID of the manager","example":"mgr_enxscjrqiiu2lrc672hwwuc5"},"DeploymentReleaseInfo":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"version":{"type":"string","minLength":1,"maxLength":256},"gitMetadata":{"$ref":"#/components/schemas/GitMetadata"},"createdAt":{"type":"string","format":"date-time"}},"required":["id","version","createdAt"]},"DeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!dg[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment group name.","example":"prod-us-east-1"},"externalId":{"type":"string","nullable":true,"minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["id","name","externalId"]},"DeploymentProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"}},"required":["id","name"]},"DeploymentStats":{"type":"object","properties":{"total":{"type":"number","description":"Total number of deployments matching filters"},"byStatus":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by status (only includes statuses with non-zero counts)"},"byPlatform":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by platform (only includes platforms with non-zero counts)"},"byCurrentRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by currentReleaseId. The empty string key represents deployments with no current release (initial provisioning)."},"byPinnedRelease":{"type":"object","additionalProperties":{"type":"number"},"description":"Count of deployments by pinnedReleaseId among deployments that are pinned. Excludes unpinned deployments."},"byOrigin":{"type":"object","properties":{"framework":{"type":"number"},"remoteOperator":{"type":"number"}},"description":"Count of deployments introduced through each deployment path."}},"required":["total","byStatus","byPlatform","byCurrentRelease","byPinnedRelease","byOrigin"]},"DeploymentDetailResponse":{"allOf":[{"$ref":"#/components/schemas/Deployment"},{"type":"object","properties":{"release":{"$ref":"#/components/schemas/DeploymentReleaseInfo"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"},"project":{"$ref":"#/components/schemas/DeploymentProjectInfo"},"operatorSync":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"dosy_[0-9a-z]{28}$","description":"Unique identifier for the deployment operator sync.","example":"dosy_uxveigz3biyrosqycaqubbr"},"status":{"$ref":"#/components/schemas/DeploymentOperatorSyncStatus"},"stuckReason":{"$ref":"#/components/schemas/DeploymentOperatorSyncStuckReason"},"statusMessage":{"type":"string","nullable":true,"description":"Human-readable explanation of the status"},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash last reported by the Operator"},"missingOperations":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Expected `plugin/operation` names not reported by the Operator (catalog-mismatch only)"},"plugins":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/DeploymentOperatorSyncPlugin"},"description":"Enabled plugins compared with what the Operator last reported loading. Null when the sync fingerprints cannot be read."},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","targetBundleHash","targetSetAt"],"description":"Plugin/operations-bundle sync status for this deployment's Operator. Null for non-pull deployments."}}}]},"ReportedOperation":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"name":{"type":"string","minLength":1,"maxLength":128}},"required":["plugin","pluginVersion","name"]},"DeploymentUpdateOperationSummary":{"type":"object","nullable":true,"properties":{"id":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"status":{"$ref":"#/components/schemas/DeploymentUpdateOperationStatus"},"reasons":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentUpdateReason"}},"targetReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"changedKeys":{"type":"array","items":{"type":"string"}},"actionRequired":{"type":"string","nullable":true,"description":"Action needed before this update can execute; the current release remains installed."},"requestedAt":{"type":"string","format":"date-time"},"startedAt":{"type":"string","format":"date-time","nullable":true},"completedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","status","reasons","targetReleaseId","changedKeys","requestedAt"]},"DeploymentUpdateOperationStatus":{"type":"string","enum":["blocked","queued","applying","succeeded","failed","superseded"]},"DeploymentUpdateReason":{"type":"string","enum":["configuration","redeploy","release"]},"DeploymentOperatorSyncStatus":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"DeploymentOperatorSyncStuckReason":{"type":"string","nullable":true,"enum":["download-failed","sync-stalled","catalog-mismatch",null]},"DeploymentOperatorSyncPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string","description":"Version the Operator should run"},"source":{"type":"string","enum":["builtin","custom"]},"state":{"type":"string","enum":["running","adding","updating","removing"],"description":"What the Operator still has to do for this plugin"},"previousVersion":{"type":"string","nullable":true,"description":"Version the Operator is running now (only while updating)"}},"required":["name","version","source","state"]},"Deployment":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId"]},"DeploymentConnectionInfo":{"type":"object","properties":{"arc":{"type":"object","properties":{"url":{"type":"string","format":"uri","description":"Manager URL for commands"},"deploymentId":{"type":"string","description":"Deployment ID to use in command requests"}},"required":["url","deploymentId"]},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"publicEndpoints":{"type":"object","additionalProperties":{"type":"object","properties":{"url":{"type":"string","format":"uri"},"protocol":{"type":"string","enum":["http","tcp"]},"host":{"type":"string","minLength":1},"port":{"type":"integer","minimum":1,"maximum":65535},"wildcardHost":{"type":"string"}},"required":["url","protocol","host","port"]},"description":"Public endpoints keyed by endpoint name."}},"required":["type"]},"description":"Deployed resources and their public endpoints"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"platform":{"type":"string"}},"required":["arc","resources","status","platform"]},"CreateDeploymentResponse":{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/Deployment"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Effective deployment model persisted for the deployment."},"token":{"type":"string","description":"Deployment token (only returned when using deployment group token)"}},"required":["deployment","deploymentModel"]},"NewDeploymentRequest":{"type":"object","properties":{"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"deploymentGroupId":{"type":"string","description":"Required for workspace/project tokens. Deployment group tokens use their own group automatically."},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Optional manager to assign. If omitted, the project default or system manager is selected."}]},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"environmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"},"description":"Configuration of environment variables for the deployment"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"project":{"type":"string","maxLength":100,"description":"Project ID or name"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"Stack settings for deployment customization"},"resourcePrefix":{"$ref":"#/components/schemas/ResourcePrefix"},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method that created the deployment. Defaults to cli."}]},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup method metadata used to guide privileged teardown."}]},"inputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"default":{},"description":"Stack input values provided by the deployment creator."},"operatorScope":{"type":"string","minLength":1,"maxLength":512,"description":"Display-only scope reported by the Operator manifest."},"operatorPermission":{"type":"string","minLength":1,"maxLength":64,"description":"Display-only permission tier reported by the Operator manifest."},"initialDesiredRelease":{"type":"string","enum":["active","none"],"default":"active","description":"Desired-release selection for a new deployment. Use none to register an environment without initially requesting a release; later updates can assign one."},"releaseChannel":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","default":"production","description":"Release channel followed while this deployment is not pinned."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Customer setup item selected from this deployment-group token."},"setupHandoff":{"type":"string","enum":["immediate","await-registration"],"default":"immediate","description":"Use await-registration when CloudFormation will create the infrastructure and register this deployment."}},"required":["name","platform","project"],"additionalProperties":false,"description":"Request schema for creating a new deployment"},"ResourcePrefix":{"type":"string","pattern":"^[a-z](?:[a-z0-9]|-(?=[a-z0-9])){1,38}[a-z0-9]$","description":"Optional physical-name prefix for generated cloud resources. Omit to let the manager generate one."},"ImportDeploymentRequest":{"oneOf":[{"$ref":"#/components/schemas/ForwardImportRequest"},{"$ref":"#/components/schemas/PersistImportedDeploymentRequest"}],"description":"Request schema for importing a deployment from resolved setup infrastructure"},"ForwardImportRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["forward"],"default":"forward"},"project":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user-session callers."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Required for user-session callers. Deployment-group tokens use their own group automatically.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager ID. If omitted, the first suitable manager for the source platform is used."}]},"source":{"$ref":"#/components/schemas/ImportSource"},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"],"description":"Exact item selected from a tailored customer setup link."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["source"]},"ImportSource":{"type":"object","properties":{"deploymentName":{"type":"string","minLength":1,"description":"User-chosen deployment name. Must be unique within the deployment group; the manager returns 409 on collision."},"resourcePrefix":{"allOf":[{"$ref":"#/components/schemas/ResourcePrefix"},{"description":"Stable physical-name prefix used by the setup artifact."}]},"sourceKind":{"$ref":"#/components/schemas/ImportSourceKind"},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"},{"description":"Setup source metadata needed to guide privileged teardown."}]},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release that produced the setup artifact. Defaults to latest.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Cloud platform of the imported stack"},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"region":{"type":"string","description":"Region or location reported by the setup artifact"},"setupTarget":{"allOf":[{"$ref":"#/components/schemas/SetupTarget"},{"description":"Setup target this package was generated for"}]},"setupImportFormatVersion":{"$ref":"#/components/schemas/SetupImportFormatVersion"},"setupFingerprint":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprint"},{"description":"Setup compatibility fingerprint embedded in the package"}]},"setupFingerprintVersion":{"allOf":[{"$ref":"#/components/schemas/SetupFingerprintVersion"},{"description":"Setup fingerprint algorithm version embedded in the package"}]},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"resources":{"type":"array","items":{"$ref":"#/components/schemas/ImportedResource"},"minItems":1}},"required":["deploymentName","resourcePrefix","platform","region","setupTarget","setupImportFormatVersion","setupFingerprint","setupFingerprintVersion","stackSettings","resources"],"description":"Resolved setup import payload"},"ImportSourceKind":{"type":"string","enum":["cloudformation","terraform","helm"],"description":"Source label for observability only — does not affect import behavior."},"KubernetesBasePlatform":{"type":"string","enum":["aws","gcp","azure"],"description":"Base cloud platform for cloud-backed Kubernetes imports."},"SetupImportFormatVersion":{"type":"integer","minimum":0,"exclusiveMinimum":true,"description":"Setup import payload format version embedded in the package"},"ImportedResource":{"type":"object","properties":{"id":{"type":"string","description":"Resource id from the active stack"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},"importData":{"type":"object","additionalProperties":{"nullable":true},"description":"Resolved typed import payload"}},"required":["id","type","importData"]},"PersistImportedDeploymentRequest":{"type":"object","properties":{"mode":{"type":"string","enum":["persist"]},"name":{"type":"string","minLength":1,"description":"Deployment name. Must be unique within the deployment group."},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Optional deployment subdomain under the project's generated-domain parent. Operator-only and requires a custom project domain; customer deploy-link tokens and the shared system domain are rejected. Omit to generate a random subdomain."},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"basePlatform":{"$ref":"#/components/schemas/KubernetesBasePlatform"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"stackState":{"nullable":true},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"runtimeMetadata":{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},"scheduleReconciliation":{"type":"boolean","default":false},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"default":"provisioning","description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"currentReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"importSource":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"setupMetadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"setupTarget":{"$ref":"#/components/schemas/SetupTarget"},"setupFingerprint":{"$ref":"#/components/schemas/SetupFingerprint"},"setupFingerprintVersion":{"$ref":"#/components/schemas/SetupFingerprintVersion"},"deploymentToken":{"type":"string"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"}},"required":["mode","name","deploymentGroupId","managerId","platform","stackSettings","runtimeMetadata","deploymentProtocolVersion","setupTarget","setupFingerprint","setupFingerprintVersion"]},"SetFirstPartyDeploymentInputsResponse":{"type":"object","properties":{"ok":{"type":"boolean"}},"required":["ok"]},"SetFirstPartyDeploymentInputsRequest":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"releaseChannel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["platform"]},"SetupRegistrationOperationResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"status":{"$ref":"#/components/schemas/SetupRegistrationOperationStatus"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"physicalResourceId":{"type":"string","nullable":true},"result":{"$ref":"#/components/schemas/SetupRegistrationOperationResult"},"error":{"type":"object","nullable":true,"properties":{"message":{"type":"string"},"retryable":{"type":"boolean"}},"required":["message","retryable"]}},"required":["id","action","sourceKind","status","deploymentId","physicalResourceId","result","error"]},"SetupRegistrationAction":{"type":"string","enum":["create","update","delete"]},"SetupRegistrationOperationStatus":{"type":"string","enum":["pending","processing","waiting-for-handoff","succeeded","failed","responding","responded"]},"SetupRegistrationOperationResult":{"type":"object","nullable":true,"properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentToken":{"type":"string","nullable":true},"helmValues":{"type":"string","nullable":true}},"required":["deploymentId","deploymentToken","helmValues"]},"CreateSetupRegistrationOperationRequest":{"type":"object","properties":{"action":{"$ref":"#/components/schemas/SetupRegistrationAction"},"sourceKind":{"allOf":[{"$ref":"#/components/schemas/ImportSourceKind"},{"description":"Package source that produced the import payload"}]},"source":{"allOf":[{"$ref":"#/components/schemas/ImportSource"}],"nullable":true},"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":512},"cloudFormation":{"$ref":"#/components/schemas/SetupRegistrationCloudFormationTarget"}},"required":["action","sourceKind"],"additionalProperties":false},"SetupRegistrationCloudFormationTarget":{"type":"object","nullable":true,"properties":{"stackId":{"type":"string","minLength":1},"requestId":{"type":"string","minLength":1},"logicalResourceId":{"type":"string","minLength":1},"responseUrl":{"type":"string","format":"uri"},"physicalResourceId":{"type":"string","nullable":true,"minLength":1},"serviceTimeoutSeconds":{"type":"integer","minimum":60,"maximum":7200,"default":3300}},"required":["stackId","requestId","logicalResourceId","responseUrl"],"additionalProperties":false},"DeleteDeploymentResponse":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]},"message":{"type":"string"}},"required":["action","message"]},"DeleteDeploymentRequest":{"type":"object","properties":{"action":{"type":"string","enum":["cleanup","detach","forget"]}},"required":["action"]},"PinReleaseRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Release ID to pin the deployment to. Set to null to resume its followed channel.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for pinning/unpinning deployment release"},"DeploymentInputsResponse":{"type":"object","properties":{"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"values":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/StackInputValueRequest"},"description":"Current non-secret input values. Secret values are never returned."},"providedInputIds":{"type":"array","items":{"type":"string"},"description":"Input IDs that currently have a value, including redacted secrets."}},"required":["inputs","values","providedInputIds"]},"UpdateDeploymentComputeRequest":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]}}},"UpdateDeploymentInputsResponse":{"allOf":[{"$ref":"#/components/schemas/DeploymentInputsResponse"},{"type":"object","properties":{"runtimeUpdateRequested":{"type":"boolean"},"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["runtimeUpdateRequested","outcome","operation"]}]},"UpdateDeploymentInputsRequest":{"type":"object","properties":{"inputValues":{"$ref":"#/components/schemas/StackInputValuesRequest"},"clearInputIds":{"type":"array","items":{"type":"string"},"default":[]}},"additionalProperties":false},"UpdateDeploymentEnvironmentVariablesRequest":{"type":"object","properties":{"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"value":{"type":"string","description":"Variable value"},"type":{"type":"string","enum":["plain","secret"],"description":"Variable type"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources)"}},"required":["name","value","type"]},"description":"Environment variables for the deployment"}},"required":["variables"],"additionalProperties":false,"description":"Request schema for updating deployment environment variables"},"CreateDeploymentTokenResponse":{"type":"object","properties":{"token":{"type":"string","description":"The generated deployment token (only shown once)"},"deploymentId":{"type":"string","description":"The deployment ID that this token is scoped to"}},"required":["token","deploymentId"]},"CreateDeploymentTokenRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128,"description":"Optional description for the deployment token"},"expiresAt":{"type":"string","format":"date-time","nullable":true,"description":"Optional expiration date for the deployment token"}},"required":["description"]},"DynamicContainerResponse":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"appliedGeneration":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"statusMessage":{"type":"string","nullable":true},"internalServices":{"type":"array","items":{"type":"object","properties":{"internalDns":{"type":"string"},"port":{"type":"integer"}},"required":["internalDns","port"]}},"deleted":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["name","spec","generation","appliedGeneration","status","statusMessage","internalServices","deleted","createdAt","updatedAt"]},"DynamicContainerName":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"DynamicContainerSpec":{"type":"object","properties":{"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"resources":{"type":"object","properties":{"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"}},"required":["cpu","memory"]},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192},"default":{}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]}},"required":["image","resources","replicas","ports"],"additionalProperties":false},"PutDynamicContainerRequest":{"type":"object","properties":{"spec":{"$ref":"#/components/schemas/DynamicContainerSpec"},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}}},"required":["spec"],"additionalProperties":false},"ListDeploymentMachinesResponse":{"type":"object","properties":{"machines":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentMachine"}}},"required":["machines"]},"DeploymentMachine":{"type":"object","properties":{"clusterResourceId":{"type":"string"},"machineId":{"type":"string"},"status":{"type":"string"},"capacityGroup":{"type":"string"},"zone":{"type":"string"},"cpu":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"memory":{"type":"object","properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"storage":{"type":"object","nullable":true,"properties":{"allocated":{"type":"number"},"systemReserve":{"type":"number"},"total":{"type":"number"}},"required":["allocated","systemReserve","total"]},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"workloadId":{"type":"string","nullable":true},"workloadName":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true},"schedulingMode":{"type":"string","nullable":true},"state":{"type":"string","nullable":true}},"required":["reason"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"overlayIp":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"horizondVersion":{"type":"string","nullable":true},"networkHealth":{"type":"string","enum":["unknown","healthy","degraded"]},"wireguardMesh":{"type":"object","nullable":true,"properties":{"expectedPeerCount":{"type":"integer","minimum":0},"reachablePeerCount":{"type":"integer","minimum":0},"missingPeerMachineIds":{"type":"array","items":{"type":"string"}}},"required":["expectedPeerCount","reachablePeerCount","missingPeerMachineIds"]},"wireguardMeshObservedAt":{"type":"string","nullable":true},"localOverrides":{"type":"array","items":{"type":"object","properties":{"activeDigest":{"type":"string","nullable":true},"actor":{"type":"string","nullable":true},"baseAssignmentHash":{"type":"string"},"baseDigest":{"type":"string","nullable":true},"candidateDigest":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"failureCategory":{"type":"string","nullable":true},"fallbackDigest":{"type":"string","nullable":true},"forcedStop":{"type":"boolean","nullable":true},"healthySince":{"type":"string","nullable":true},"incidentId":{"type":"string","nullable":true},"lifecycle":{"type":"string"},"phaseStartedAt":{"type":"string","nullable":true},"replicaId":{"type":"string"},"workloadName":{"type":"string"}},"required":["baseAssignmentHash","lifecycle","replicaId","workloadName"]}},"localOverridesObservedAt":{"type":"string","nullable":true},"replicaCount":{"type":"integer"}},"required":["clusterResourceId","machineId","status","capacityGroup","zone","cpu","memory","drainBlockers","drainForce","lastHeartbeat","localOverrides","replicaCount"]},"DeploymentCredentialRotationStatus":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0},"rotation":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}},"required":["deploymentId","revision","rotation"]},"DeploymentCredentialRotation":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"expiresAt":{"type":"string"}},"required":["id","revision","status","expiresAt"]},"DeploymentCredentialRotationValues":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"token":{"type":"string"}},"required":["deploymentId","revision","token"]},"VolumeRestore":{"type":"object","properties":{"id":{"type":"string","pattern":"vrst_[0-9a-z]{28}$","description":"Unique identifier for the volume restore.","example":"vrst_rs1j4dytswpy7wbc819jdcx"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string"},"ordinal":{"type":"integer","minimum":0},"snapshotId":{"type":"string"},"status":{"$ref":"#/components/schemas/VolumeRestoreStatus"},"createdBy":{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Principal that requested the restore"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"completedAt":{"type":"string","format":"date-time","nullable":true},"cancelledAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","deploymentId","resourceId","ordinal","snapshotId","status","createdBy","createdAt","updatedAt","completedAt","cancelledAt"],"description":"A request to replace one replica's persistent volume with a volume made from a snapshot"},"VolumeRestoreStatus":{"type":"string","enum":["pending","completed","cancelled"],"description":"pending: sent to the deployment until the container reports it done. If the restore fails, the container's resource shows the error and the request stays pending: retry the deployment or cancel the request. completed: the container reported the restored volume. cancelled: withdrawn before it completed."},"CreateVolumeRestoreRequest":{"type":"object","properties":{"resourceId":{"type":"string","minLength":1,"maxLength":64,"description":"ID of the container resource that owns the volume"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"snapshotId":{"type":"string","minLength":1,"maxLength":1024,"description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute Engine snapshot name, or an Azure snapshot resource ID"}},"required":["resourceId","ordinal","snapshotId"],"additionalProperties":false},"ListVolumeRestoresResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/VolumeRestore"}}},"required":["items"]},"CreateManagerResponse":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["pending"]},"setupToken":{"type":"string"},"setupTokenId":{"type":"string"},"deploymentLink":{"type":"string"},"setupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"inputValues":{"$ref":"#/components/schemas/EncryptedStackInputValues"},"validatedReleaseSelection":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["releaseId","releaseChannel","platform"],"additionalProperties":false,"description":"Immutable Release whose schema validated first-party inputs for this platform and channel."},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8,"description":"Immutable setup items and exact sources captured when this setup link is created."},"publicSubdomain":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Operator-pinned deployment subdomain for this setup token."},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"type":{"type":"string","enum":["plain","secret"]},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"}}},"required":["name","type","targetResources"]}}},"required":["metadata","policy","environmentVariables"]},"setup":{"oneOf":[{"type":"object","properties":{"method":{"type":"string","enum":["cloudformation"]},"deploymentPortalUrl":{"type":"string"},"launchUrl":{"type":"string"},"templateUrl":{"type":"string"},"stackName":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","launchUrl","templateUrl","stackName","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["google-oauth"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"oauthStartUrl":{"type":"string"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","oauthStartUrl","region","stackSettings"]},{"type":"object","properties":{"method":{"type":"string","enum":["terraform"]},"deploymentPortalUrl":{"type":"string"},"managerUrl":{"type":"string"},"providerSource":{"type":"string"},"moduleSource":{"type":"string"},"moduleVersion":{"type":"string"},"moduleInputs":{"type":"object","additionalProperties":{"type":"string"}},"mainTf":{"type":"string"},"tfvars":{"type":"string"},"commands":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["method","deploymentPortalUrl","managerUrl","providerSource","moduleSource","moduleInputs","mainTf","tfvars","commands","stackSettings"]}]}},"required":["managerId","setupStatus","setupToken","setupTokenId","deploymentLink","setupConfig","setup"]},"DeploymentSetupPolicy":{"type":"object","properties":{"allowedPlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"allowedAIProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6,"description":"AI providers the recipient may connect. Omit to allow every provider supported by the Project."},"allowedKubernetesBasePlatforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","on-prem"]},"minItems":1,"description":"Kubernetes base environments the recipient may target."},"allowedKubernetesClusterSources":{"type":"array","items":{"$ref":"#/components/schemas/KubernetesClusterSource"},"minItems":1,"description":"Whether recipients may create a cluster, use an existing cluster, or both."},"allowedSetupMethods":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentSetupMethod"}},"allowReleasePinning":{"type":"boolean"},"stackSettings":{"$ref":"#/components/schemas/DeploymentSetupStackSettingsPolicy"}},"required":["allowedPlatforms","allowedSetupMethods"]},"EncryptedStackInputValues":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/EncryptedStackInputValue"},"default":{}},"EncryptedStackInputValue":{"type":"object","properties":{"value":{"type":"string","description":"Encrypted JSON-encoded input value."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"]},"secret":{"type":"boolean","description":"Whether the original input is secret."}},"required":["value","kind","secret"]},"NewManagerRequest":{"type":"object","properties":{"name":{"type":"string"},"cloud":{"$ref":"#/components/schemas/PrivateManagerCloud"},"region":{"type":"string","minLength":1,"maxLength":64,"description":"Cloud region for the manager."},"setupMethod":{"$ref":"#/components/schemas/PrivateManagerSetupMethod"},"network":{"type":"string","enum":["create","default"],"description":"Optional network mode for the private-manager setup. Defaults to create for production isolation; default uses the provider default network for faster dev/test setup."},"otlpConfig":{"type":"object","properties":{"logsEndpoint":{"type":"string","format":"uri","description":"External OTLP logs endpoint (e.g. https://api.axiom.co/v1/logs)"},"logsAuthHeader":{"type":"string","description":"Auth header in 'key=value,...' format (e.g. 'authorization=Bearer <token>,x-axiom-dataset=<dataset>')"}},"required":["logsEndpoint","logsAuthHeader"],"description":"Optional external OTLP config for forwarding logs to Axiom, Datadog, etc. Falls back to built-in DeepStore when not set."}},"required":["name","cloud","region"]},"PrivateManagerCloud":{"type":"string","enum":["aws","gcp","azure"],"description":"Cloud where the private manager will be deployed."},"PrivateManagerSetupMethod":{"type":"string","enum":["cloudformation","google-oauth","terraform"],"description":"Optional setup method. Defaults to cloudformation for AWS, google-oauth for GCP, and terraform for Azure."},"ManagerRetryResponse":{"oneOf":[{"allOf":[{"$ref":"#/components/schemas/CreateManagerResponse"},{"type":"object","properties":{"mode":{"type":"string","enum":["setup"]}},"required":["mode"]}]},{"$ref":"#/components/schemas/ManagerRetryDeploymentResponse"}]},"ManagerRetryDeploymentResponse":{"type":"object","properties":{"mode":{"type":"string","enum":["deployment"]},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"setupStatus":{"type":"string","enum":["provisioning"]},"deploymentId":{"type":"string"},"message":{"type":"string"}},"required":["mode","managerId","setupStatus","deploymentId","message"]},"Manager":{"type":"object","properties":{"id":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for the manager"}]},"name":{"type":"string","description":"Display name of the manager"},"targets":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms this manager can handle"},"cloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where this private manager is deployed"},"region":{"type":"string","nullable":true,"description":"Cloud region selected for this private manager"},"setupStatus":{"type":"string","nullable":true,"enum":["pending","provisioning","active","failed","deleting","deleted",null],"description":"Private manager setup lifecycle status"},"url":{"type":"string","nullable":true,"format":"uri","description":"Manager URL (self-reported via heartbeat). DeepStore endpoints are exposed through this URL (e.g., {url}/v1/logs)"},"managementConfigs":{"$ref":"#/components/schemas/ManagerManagementConfigs"},"isSystem":{"type":"boolean","description":"Whether this is a system manager (Alien-hosted)"},"workspaceId":{"type":"string","description":"The workspace ID (for system managers, this is ALIEN_WORKSPACE_ID)"},"status":{"$ref":"#/components/schemas/ManagerStatus"},"version":{"type":"string","nullable":true,"description":"Manager version (self-reported via heartbeat)"},"metrics":{"type":"object","nullable":true,"properties":{"activeDeployments":{"type":"number","description":"Number of active deployments"},"pendingDeployments":{"type":"number","description":"Number of pending deployments"},"memoryUsageMb":{"type":"number","description":"Memory usage in megabytes"},"cpuUsagePercent":{"type":"number","description":"CPU usage percentage"}},"description":"Runtime metrics (self-reported via heartbeat)"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the manager"},"logsDatabaseId":{"type":"string","nullable":true,"description":"ID of the logs database associated with this manager"},"managedDeploymentCount":{"type":"integer","minimum":0,"description":"Number of deployments currently being managed by this manager"},"defaultProjectCount":{"type":"integer","minimum":0,"description":"Number of projects that select this manager as a default manager"},"createdAt":{"type":"string","format":"date-time","description":"Timestamp when the manager was created"}},"required":["id","name","targets","managementConfigs","isSystem","workspaceId","status","managedDeploymentCount","defaultProjectCount","createdAt"],"description":"Manager schema"},"ManagerManagementConfigs":{"type":"object","properties":{"aws":{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"},"platform":{"type":"string","enum":["aws"]}},"required":["managingRoleArn","platform"]},"gcp":{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"},"platform":{"type":"string","enum":["gcp"]}},"required":["serviceAccountEmail","platform"]},"azure":{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."},"platform":{"type":"string","enum":["azure"]}},"required":["managingTenantId","oidcIssuer","oidcSubject","platform"]},"kubernetes":{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}},"description":"Per-platform management configurations for cross-account access (self-reported via heartbeat)"},"ManagerStatus":{"type":"string","enum":["healthy","degraded","unhealthy","unknown"],"description":"Current health status"},"ManagerDomainBindingResponse":{"type":"object","properties":{"managerDomainBinding":{"$ref":"#/components/schemas/DomainEndpoint"}},"required":["managerDomainBinding"]},"UpdateManagerDomainBinding":{"type":"object","properties":{"domainId":{"type":"string","nullable":true,"pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"}},"additionalProperties":false},"UpdateManagerRequest":{"type":"object","properties":{"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Optional release ID to update to. If not provided, the active release will be chosen","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"additionalProperties":false,"description":"Request schema for updating a manager to a new release"},"Event":{"type":"object","properties":{"id":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"deploymentId":{"type":"string","nullable":true,"pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"releaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"debugSessionId":{"type":"string","nullable":true,"pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"data":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["LoadingConfiguration"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["Finished"]}},"required":["type"]},{"type":"object","properties":{"stack":{"type":"string","description":"Name of the stack being built"},"type":{"type":"string","enum":["BuildingStack"]}},"required":["stack","type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform being targeted"},"stack":{"type":"string","description":"Name of the stack being checked"},"type":{"type":"string","enum":["RunningPreflights"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"targetTriple":{"type":"string","description":"Target triple for the runtime"},"type":{"type":"string","enum":["DownloadingAlienRuntime"]},"url":{"type":"string","description":"URL being downloaded from"}},"required":["targetTriple","type","url"]},{"type":"object","properties":{"relatedResources":{"type":"array","items":{"type":"string"},"description":"All resource names sharing this build (for deduped container groups)"},"resourceName":{"type":"string","description":"Name of the resource being built"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["BuildingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being built"},"type":{"type":"string","enum":["BuildingImage"]}},"required":["image","type"]},{"type":"object","properties":{"image":{"type":"string","description":"Name of the image being pushed"},"progress":{"oneOf":[{"type":"object","properties":{"bytesUploaded":{"type":"integer","minimum":0,"description":"Bytes uploaded so far"},"layersUploaded":{"type":"integer","minimum":0,"description":"Number of layers uploaded so far"},"operation":{"type":"string","description":"Current operation being performed"},"totalBytes":{"type":"integer","minimum":0,"description":"Total bytes to upload"},"totalLayers":{"type":"integer","minimum":0,"description":"Total number of layers to upload"}},"required":["bytesUploaded","layersUploaded","operation","totalBytes","totalLayers"],"description":"Progress information for image push operations"},{"nullable":true}]},"type":{"type":"string","enum":["PushingImage"]}},"required":["image","type"]},{"type":"object","properties":{"destination":{"type":"string","nullable":true,"description":"Human-readable destination for pushed images"},"platform":{"type":"string","description":"Target platform"},"stack":{"type":"string","description":"Name of the stack being pushed"},"type":{"type":"string","enum":["PushingStack"]}},"required":["platform","stack","type"]},{"type":"object","properties":{"resourceName":{"type":"string","description":"Name of the resource being pushed"},"resourceType":{"type":"string","description":"Type of the resource: \"worker\", \"container\""},"type":{"type":"string","enum":["PushingResource"]}},"required":["resourceName","resourceType","type"]},{"type":"object","properties":{"project":{"type":"string","description":"Project name"},"type":{"type":"string","enum":["CreatingRelease"]}},"required":["project","type"]},{"type":"object","properties":{"language":{"type":"string","description":"Language being compiled (rust, typescript, etc.)"},"progress":{"type":"string","nullable":true,"description":"Current progress/status line from the build output"},"type":{"type":"string","enum":["CompilingCode"]}},"required":["language","type"]},{"type":"object","properties":{"nextState":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},"suggestedDelayMs":{"type":"integer","nullable":true,"minimum":0,"description":"An suggested duration to wait before executing the next step."},"type":{"type":"string","enum":["StackStep"]}},"required":["nextState","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["GeneratingCloudFormationTemplate"]}},"required":["type"]},{"type":"object","properties":{"platform":{"type":"string","description":"Platform for which the template is being generated"},"type":{"type":"string","enum":["GeneratingTemplate"]}},"required":["platform","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being provisioned"},"releaseId":{"type":"string","description":"ID of the release being deployed to the agent"},"type":{"type":"string","enum":["ProvisioningAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being updated"},"releaseId":{"type":"string","description":"ID of the new release being deployed to the agent"},"type":{"type":"string","enum":["UpdatingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being deleted"},"releaseId":{"type":"string","description":"ID of the release that was running on the agent"},"type":{"type":"string","enum":["DeletingAgent"]}},"required":["agentId","releaseId","type"]},{"type":"object","properties":{"agentId":{"type":"string","description":"ID of the agent being debugged"},"debugSessionId":{"type":"string","description":"ID of the debug session"},"type":{"type":"string","enum":["DebuggingAgent"]}},"required":["agentId","debugSessionId","type"]},{"type":"object","properties":{"strategyName":{"type":"string","description":"Name of the deployment strategy being used"},"type":{"type":"string","enum":["PreparingEnvironment"]}},"required":["strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being deployed"},"type":{"type":"string","enum":["DeployingStack"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being tested"},"type":{"type":"string","enum":["RunningTestWorker"]}},"required":["stackName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpStack"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"stackName":{"type":"string","description":"Name of the stack being cleaned up"},"strategyName":{"type":"string","description":"Name of the deployment strategy being used for cleanup"},"type":{"type":"string","enum":["CleaningUpEnvironment"]}},"required":["stackName","strategyName","type"]},{"type":"object","properties":{"platformName":{"type":"string","description":"Name of the platform (e.g., \"AWS\", \"GCP\")"},"type":{"type":"string","enum":["SettingUpPlatformContext"]}},"required":["platformName","type"]},{"type":"object","properties":{"repositoryName":{"type":"string","description":"Name of the docker repository"},"type":{"type":"string","enum":["EnsuringDockerRepository"]}},"required":["repositoryName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeployingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"roleArn":{"type":"string","description":"ARN of the role to assume"},"type":{"type":"string","enum":["AssumingRole"]}},"required":["roleArn","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"type":{"type":"string","enum":["ImportingStackStateFromCloudFormation"]}},"required":["cfnStackName","type"]},{"type":"object","properties":{"cfnStackName":{"type":"string","description":"Name of the CloudFormation stack"},"currentStatus":{"type":"string","description":"Current stack status"},"type":{"type":"string","enum":["DeletingCloudFormationStack"]}},"required":["cfnStackName","currentStatus","type"]},{"type":"object","properties":{"bucketNames":{"type":"array","items":{"type":"string"},"description":"Names of the S3 buckets being emptied"},"type":{"type":"string","enum":["EmptyingBuckets"]}},"required":["bucketNames","type"]},{"type":"object","properties":{"deploymentGroupId":{"type":"string","description":"ID of the deployment group this slot belongs to"},"deploymentId":{"type":"string","description":"ID of the deployment that was created"},"releaseId":{"type":"string","nullable":true,"description":"Initial release the slot was created with, if any"},"type":{"type":"string","enum":["DeploymentCreated"]}},"required":["deploymentGroupId","deploymentId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously live, if any"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentReleased"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release the platform was trying to deploy, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"phase":{"type":"string","enum":["preflights","provisioning","updating","deleting"],"description":"Phase of a deployment at which a failure occurred.\n\nDerived from the source deployment status: `preflights-failed` →\n`Preflights`, `provisioning-failed` → `Provisioning`, `update-failed` →\n`Updating`, `delete-failed` → `Deleting`.\n`refresh-failed` is modelled separately via `DeploymentDegraded`."},"type":{"type":"string","enum":["DeploymentFailed"]}},"required":["deploymentId","error","phase","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"error":{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},"type":{"type":"string","enum":["DeploymentDegraded"]}},"required":["deploymentId","error","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release that is now live"},"type":{"type":"string","enum":["DeploymentRecovered"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment that was deleted"},"type":{"type":"string","enum":["DeploymentDeleted"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Name of the channel that moved"},"previousReleaseId":{"type":"string","nullable":true,"description":"ID of the release that was previously current, if any"},"releaseId":{"type":"string","description":"ID of the release that is now current"},"type":{"type":"string","enum":["ReleaseChannelUpdated"]}},"required":["channel","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"channel":{"type":"string","description":"Newly followed channel"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousChannel":{"type":"string","description":"Previously followed channel"},"type":{"type":"string","enum":["DeploymentReleaseChannelChanged"]}},"required":["channel","deploymentId","previousChannel","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"attemptedReleaseId":{"type":"string","nullable":true,"description":"ID of the release that the failed attempt was targeting, if known"},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousError":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"type":{"type":"string","enum":["DeploymentRetryRequested"]}},"required":["deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"releaseId":{"type":"string","description":"ID of the release being redeployed"},"type":{"type":"string","enum":["DeploymentRedeployRequested"]}},"required":["deploymentId","releaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"pinnedReleaseId":{"type":"string","description":"ID of the release that is now pinned"},"previousPinnedReleaseId":{"type":"string","nullable":true,"description":"ID of the previously pinned release, if any"},"type":{"type":"string","enum":["DeploymentReleasePinned"]}},"required":["deploymentId","pinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"previousPinnedReleaseId":{"type":"string","description":"ID of the release that was previously pinned"},"type":{"type":"string","enum":["DeploymentReleaseUnpinned"]}},"required":["deploymentId","previousPinnedReleaseId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"changedKeys":{"type":"array","items":{"type":"string"},"description":"Names of the environment variables that changed (added, removed, or modified)"},"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentEnvironmentUpdated"]}},"required":["changedKeys","deploymentId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"ID of the volume restore request"},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore"},"type":{"type":"string","enum":["DeploymentVolumeRestoreRequested"]}},"required":["deploymentId","ordinal","requestId","resourceId","snapshotId","type"]},{"type":"object","properties":{"actor":{"oneOf":[{"type":"object","properties":{"email":{"type":"string","nullable":true,"description":"User email when the principal is a user."},"id":{"type":"string","description":"Stable user or service-account identifier."},"kind":{"type":"string","enum":["user","serviceAccount"],"description":"Type of authenticated principal that requested an event."},"via":{"oneOf":[{"type":"string","enum":["mcp"],"description":"Client channel that carried a principal's request."},{"nullable":true}]}},"required":["id","kind"],"description":"Authenticated principal that requested a deployment intent event."},{"nullable":true}]},"deploymentId":{"type":"string","description":"ID of the deployment"},"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume was to be replaced"},"requestId":{"type":"string","description":"ID of the cancelled volume restore request"},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"type":{"type":"string","enum":["DeploymentVolumeRestoreCancelled"]}},"required":["deploymentId","ordinal","requestId","resourceId","type"]},{"type":"object","properties":{"deploymentId":{"type":"string","description":"ID of the deployment"},"type":{"type":"string","enum":["DeploymentDeletionRequested"]}},"required":["deploymentId","type"]},{"$ref":"#/components/schemas/DeploymentCredentialRotationEvent"}]},"state":{"oneOf":[{"type":"object","properties":{"failed":{"type":"object","properties":{"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]}},"description":"Event failed with an error"}},"required":["failed"]},{"type":"string","enum":["none"]},{"type":"string","enum":["started"]},{"type":"string","enum":["success"]}],"description":"Represents the state of an event"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"createdAt":{"type":"string","format":"date-time"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","data","state","projectId","createdAt","workspaceId"]},"DeploymentCredentialRotationEvent":{"type":"object","properties":{"type":{"type":"string","enum":["DeploymentCredentialRotation"]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"rotationId":{"type":"string"},"revision":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["prepared","completed","cancelled"]},"previousKeyId":{"type":"string"},"candidateKeyId":{"type":"string"},"actor":{"type":"object","properties":{"kind":{"type":"string","enum":["user","serviceAccount"]},"id":{"type":"string"}},"required":["kind","id"]}},"required":["type","deploymentId","rotationId","revision","status","previousKeyId","candidateKeyId","actor"]},"GenerateManagerTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string","description":"Platform JWT for authenticating with the manager"},"expiresIn":{"type":"number","nullable":true,"description":"Token lifetime in seconds"},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string","description":"Manager URL for direct access"},"databaseId":{"type":"string","nullable":true,"description":"Log database ID (null if logs not configured)"},"controlPlaneUrl":{"type":"string","nullable":true,"description":"Log control plane URL (null if logs not configured)"}},"required":["accessToken","expiresIn","tokenType","managerUrl","databaseId","controlPlaneUrl"]},"GenerateManagerTokenRequest":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to scope token access to."}},"required":["project"]},"GenerateManagerBindingTokenResponse":{"type":"object","properties":{"accessToken":{"type":"string"},"expiresIn":{"type":"number","nullable":true},"tokenType":{"type":"string","enum":["Bearer"]},"managerUrl":{"type":"string"}},"required":["accessToken","expiresIn","tokenType","managerUrl"]},"GenerateManagerBindingTokenRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"kind":{"type":"string","enum":["data","sandbox"],"description":"Binding kind the token resolves. Defaults to the deployment's own kind: sandbox for a sandbox deployment, data otherwise."}},"required":["deploymentId"],"additionalProperties":false},"ResolveManagerGcpOAuthProviderResponse":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["alien-managed"]}},"required":["mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["custom"]},"clientId":{"$ref":"#/components/schemas/GcpOAuthClientId"},"clientSecret":{"$ref":"#/components/schemas/GcpOAuthClientSecret"}},"required":["mode","clientId","clientSecret"]}]},"ResolveManagerGcpOAuthProviderRequest":{"type":"object","properties":{"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group bearer token whose project-level OAuth provider should be resolved."},"returnOrigin":{"type":"string","format":"uri","description":"Browser origin that will receive the Google OAuth callback result. Must be a first-party dashboard origin or the active portal origin for the deployment group's project."}},"required":["deploymentGroupToken"]},"ManagerHeartbeatResponse":{"type":"object","properties":{"acknowledged":{"type":"boolean"},"timestamp":{"type":"string"}},"required":["acknowledged","timestamp"]},"ManagerHeartbeatRequest":{"type":"object","properties":{"status":{"type":"string","enum":["healthy","degraded","unhealthy"],"description":"Current health status"},"version":{"type":"string","description":"Manager version"},"url":{"type":"string","format":"uri","description":"Manager public URL (for accessing DeepStore endpoints)"},"managementConfigs":{"allOf":[{"$ref":"#/components/schemas/ManagerManagementConfigs"},{"description":"Per-platform management configurations for cross-account access"}]},"metrics":{"type":"object","properties":{"activeDeployments":{"type":"number"},"pendingDeployments":{"type":"number"},"memoryUsageMb":{"type":"number"},"cpuUsagePercent":{"type":"number"}},"description":"Optional runtime metrics"}},"required":["status","url","managementConfigs"]},"ManagerDeployment":{"type":"object","properties":{"platform":{"type":"string","description":"Platform of the internal deployment"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status of the internal deployment"},"deploymentId":{"type":"string","description":"Internal deployment ID"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Currently deployed private manager release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Target private manager release for an in-progress update","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"error":{"nullable":true,"description":"Latest provision / upgrade / delete error"},"resources":{"type":"object","additionalProperties":{"type":"object","properties":{"type":{"type":"string","description":"Resource type"},"status":{"type":"string","description":"Resource status"},"outputs":{"type":"object","additionalProperties":{"nullable":true},"description":"Resource outputs"}},"required":["type","status"]},"description":"Simplified stack state resources"},"environmentInfo":{"nullable":true,"description":"Manager environment info"}},"required":["platform","status","deploymentId","resources"]},"ContainerRegistryManagerSnapshot":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"routes":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string"},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"routableUpstreamName":{"type":"string","nullable":true},"remoteResourceRevision":{"type":"string"}},"required":["id","logicalName","desiredState","routableUpstreamName","remoteResourceRevision"],"additionalProperties":false}},"credentials":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"secretPrefix":{"type":"string"},"secretDigest":{"type":"string","pattern":"^[0-9a-f]{64}$"},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string"}},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","secretPrefix","secretDigest","scope","repositorySubset","expiresAt","revokedAt"],"additionalProperties":false}}},"required":["id","deploymentId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","repositories","credentials"],"additionalProperties":false}}},"required":["generatedAt","routes"],"additionalProperties":false},"ApplyContainerRegistrySnapshotResponse":{"type":"object","properties":{"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["applying","connected","degraded","revoked"]}},"required":["appliedRevision","status"],"additionalProperties":false},"PrepareOperatorManifestPackageResponse":{"type":"object","properties":{"package":{"$ref":"#/components/schemas/Package"}},"required":["package"]},"PrepareOperatorManifestPackageRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}},"required":["project"],"additionalProperties":false},"RenderOperatorManifestResponse":{"type":"object","properties":{"manifest":{"type":"string","description":"Rendered multi-document Kubernetes manifest"},"applyCommand":{"type":"string","description":"kubectl command for applying the manifest from a file"},"filename":{"type":"string","description":"Suggested local filename"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the manifest"},"imagePending":{"type":"boolean","description":"True when the operator image is still building. The manifest contains a placeholder image (<PENDING_IMAGE>) and must not be applied yet — re-render once the operator-image package is ready to get the real image."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["manifest","applyCommand","filename","managerUrl","imagePending","operatorImage"]},"RenderOperatorManifestRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"format":{"type":"string","enum":["raw","helm"],"default":"raw","description":"raw: a kubectl-applyable manifest for one cluster. helm: a paste-into-your-chart template whose namespace and environment name come from Helm at install time."},"environmentName":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Per-environment identity. Required for raw output, ignored for helm.","example":"my-app"},"namespace":{"type":"string","minLength":1,"maxLength":63,"pattern":"^[a-z0-9]([-a-z0-9]*[a-z0-9])?$","description":"Namespace to observe and install into. Omit for helm to use the release namespace."},"scope":{"type":"string","enum":["namespace","cluster"],"default":"namespace","description":"namespace: a namespaced Role that manages the install namespace. cluster: a ClusterRole that manages every namespace."},"labelSelector":{"type":"string","minLength":1,"maxLength":256,"description":"Optional Kubernetes label selector narrowing what is managed, applied within the scope."},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to use for the Operator image. If omitted, the latest ready operator-image package for the project is used.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"deploymentGroupToken":{"type":"string","minLength":1,"description":"Deployment-group token embedded in the operator Secret"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","default":false},"podLabelKey":{"type":"string","minLength":1,"description":"Existing Pod label key to collect logs from. Set with podLabelValue."},"podLabelValue":{"type":"string","minLength":1,"description":"Existing Pod label value to collect logs from. Set with podLabelKey."}},"description":"Enable the node log collector DaemonSet for raw pod logs."},"stackSettings":{"$ref":"#/components/schemas/StackSettings"}},"required":["project","deploymentGroupToken"],"additionalProperties":false},"StackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"EcsBootstrapWriteCheckRequest":{"type":"object","properties":{"stackName":{"type":"string","pattern":"^[A-Za-z][A-Za-z0-9-]{0,127}$"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"}},"required":["stackName","accountId","region","clusterArn"],"additionalProperties":false},"RenderOperatorEcsCloudFormationResponse":{"type":"object","properties":{"template":{"type":"string","nullable":true,"description":"CloudFormation JSON for an ECS Fargate service, or null while the immutable Operator image is building. The artifact contains no bootstrap credential values."},"filename":{"type":"string","description":"Suggested local CloudFormation filename"},"stackName":{"type":"string","description":"Suggested stack name for this installation"},"deployCommand":{"type":"string","nullable":true,"description":"Local bash/zsh deploy command, or null while the image is building. Before writing a bootstrap secret, it asks Alien to verify the one-time setup token and registration state, then preserves or generates the encryption key and writes both to customer-owned Secrets Manager. Once an Operator has registered from this stack, it reuses the stored secret at its current version and never asks for a token. It passes only the secret ARN and version ID to CloudFormation."},"managerUrl":{"type":"string","format":"uri","description":"Manager URL embedded in the task definition"},"image":{"type":"string","description":"Immutable Operator image reference, or <PENDING_IMAGE>"},"imagePending":{"type":"boolean","description":"True until a ready Operator image digest is available. A pending template must not be deployed."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["template","filename","stackName","deployCommand","managerUrl","image","imagePending","operatorImage"]},"RenderOperatorEcsCloudFormationRequest":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"environmentName":{"type":"string","minLength":2,"maxLength":100,"pattern":"^[a-z0-9]([a-z0-9-]*[a-z0-9])?$","description":"Stable per-environment Remote Operator installation name"},"permission":{"type":"string","enum":["diagnostics","remediation"],"default":"diagnostics","description":"Operator permission tier"},"accountId":{"type":"string","pattern":"^[0-9]{12}$","description":"Exact AWS account that owns the Remote Operator stack"},"region":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-[0-9]$","description":"Exact AWS Region for the Remote Operator stack"},"clusterArn":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):ecs:[a-z]{2}(?:-gov)?-[a-z]+-[0-9]:[0-9]{12}:cluster\\/[A-Za-z0-9_-]{1,255}$","description":"Exact ARN of the customer-owned ECS cluster"},"subnetIds":{"type":"array","items":{"type":"string","pattern":"^subnet-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact subnet ID for an Operator task ENI"},"minItems":1,"maxItems":16},"securityGroupIds":{"type":"array","items":{"type":"string","pattern":"^sg-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Exact security group ID for an Operator task ENI"},"minItems":1,"maxItems":16},"assignPublicIp":{"type":"string","enum":["DISABLED","ENABLED"],"default":"DISABLED"},"efsFileSystemId":{"type":"string","pattern":"^fs-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS filesystem ID for the Operator identity. Omit it, with efsAccessPointId, to have the stack create retained EFS storage."},"efsAccessPointId":{"type":"string","pattern":"^fsap-(?:[0-9a-f]{8}|[0-9a-f]{17})$","description":"Existing EFS access point ID (POSIX UID and GID 1000) on efsFileSystemId. Supply it together with efsFileSystemId."},"operatorImagePackageId":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Ready operator-image package to pin in the task definition. If omitted, the current project package is prepared or reused.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"s3BucketArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$","description":"Exact ARN of an S3 bucket the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned S3 ceiling. Required when enabled S3 operations need ListBucket or GetObject; the generated role contains only these bucket and object ARNs."},"sqsQueueArns":{"type":"array","items":{"type":"string","pattern":"^arn:(aws|aws-cn|aws-us-gov):sqs:[a-z0-9]+(?:-[a-z0-9]+)+:[0-9]{12}:(?:[A-Za-z0-9_-]{1,80}|[A-Za-z0-9_-]{1,75}\\.fifo)$","description":"Exact ARN of an SQS queue the selected operations may inspect"},"maxItems":50,"default":[],"description":"Installer-owned SQS ceiling. Required when enabled SQS operations read queue attributes; the generated role contains only these queue ARNs."}},"required":["project","environmentName","accountId","region","clusterArn","subnetIds","securityGroupIds"],"additionalProperties":false},"APIKey":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"},"createdByUser":{"type":"object","nullable":true,"properties":{"id":{"type":"string"},"email":{"type":"string"},"image":{"type":"string","nullable":true}},"required":["id","email","image"],"description":"User information associated with the API key"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig","createdByUser"],"description":"API key information"},"APIKeyDeploymentSetupConfig":{"type":"object","nullable":true,"properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"$ref":"#/components/schemas/APIKeyDeploymentSetupEnvironmentVariable"}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8}},"required":["metadata","policy","environmentVariables"]},"APIKeyDeploymentSetupEnvironmentVariable":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]},"CreateAPIKeyResponse":{"type":"object","properties":{"apiKey":{"type":"string","description":"The generated API key value (only shown once)"},"keyInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"description":{"type":"string","nullable":true},"keyPrefix":{"type":"string"},"type":{"type":"string","enum":["workspace","project","deployment","deployment-group","manager"]},"role":{"type":"string"},"workspaceId":{"type":"string"},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"managerId":{"type":"string","nullable":true},"enabled":{"type":"boolean"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","nullable":true,"format":"date-time"},"lastUsedAt":{"type":"string","nullable":true,"format":"date-time"},"revokedAt":{"type":"string","nullable":true,"format":"date-time"},"deploymentSetupConfig":{"$ref":"#/components/schemas/APIKeyDeploymentSetupConfig"}},"required":["id","description","keyPrefix","type","role","workspaceId","projectId","deploymentId","deploymentGroupId","managerId","enabled","createdAt","expiresAt","lastUsedAt","revokedAt","deploymentSetupConfig"]}},"required":["apiKey","keyInfo"],"description":"Response containing the new API key and its metadata"},"CreateAPIKeyRequest":{"type":"object","properties":{"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"scope":{"$ref":"#/components/schemas/Scope"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"required":["description","scope","expiresAt"],"description":"Request schema for creating a new API key"},"Scope":{"oneOf":[{"$ref":"#/components/schemas/WorkspaceScope"},{"$ref":"#/components/schemas/ProjectScope"},{"$ref":"#/components/schemas/DeploymentScope"},{"$ref":"#/components/schemas/DeploymentGroupScope"},{"$ref":"#/components/schemas/ManagerScope"}],"discriminator":{"propertyName":"type","mapping":{"workspace":"#/components/schemas/WorkspaceScope","project":"#/components/schemas/ProjectScope","deployment":"#/components/schemas/DeploymentScope","deployment-group":"#/components/schemas/DeploymentGroupScope","manager":"#/components/schemas/ManagerScope"}},"description":"Scope and role configuration for service accounts"},"WorkspaceScope":{"type":"object","properties":{"type":{"type":"string","enum":["workspace"]},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["type","role"],"description":"Workspace-scoped configuration"},"ProjectScope":{"type":"object","properties":{"type":{"type":"string","enum":["project"]},"projectId":{"type":"string","description":"ID of the project this is scoped to"},"role":{"$ref":"#/components/schemas/ProjectRole"}},"required":["type","projectId","role"],"description":"Project-scoped configuration"},"DeploymentScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment"]},"deploymentId":{"type":"string","description":"ID of the deployment this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment belongs to"},"role":{"$ref":"#/components/schemas/DeploymentRole"}},"required":["type","deploymentId","projectId","role"],"description":"Deployment-scoped configuration"},"DeploymentGroupScope":{"type":"object","properties":{"type":{"type":"string","enum":["deployment-group"]},"deploymentGroupId":{"type":"string","description":"ID of the deployment group this is scoped to"},"projectId":{"type":"string","description":"ID of the project this deployment group belongs to"},"role":{"$ref":"#/components/schemas/DeploymentGroupRole"}},"required":["type","deploymentGroupId","projectId","role"],"description":"Deployment group-scoped configuration"},"ManagerScope":{"type":"object","properties":{"type":{"type":"string","enum":["manager"]},"managerId":{"type":"string","description":"ID of the manager this is scoped to"},"role":{"$ref":"#/components/schemas/ManagerRole"}},"required":["type","managerId","role"],"description":"Manager-scoped configuration"},"UpdateAPIKeyRequest":{"type":"object","properties":{"enabled":{"type":"boolean"},"description":{"type":"string","nullable":true,"minLength":3,"maxLength":128},"deploymentSetupConfig":{"$ref":"#/components/schemas/UpdateDeploymentSetupPolicy"},"expiresAt":{"type":"string","nullable":true,"format":"date-time","description":"Optional expiration date for the API key"}},"description":"Request schema for updating an API key"},"UpdateDeploymentSetupPolicy":{"type":"object","properties":{"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"}},"required":["policy"],"description":"Editable part of a deployment link's setup config. Locked env vars and input values are preserved."},"DeleteAPIKeysRequest":{"type":"object","properties":{"ids":{"type":"array","items":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"minItems":1}},"required":["ids"]},"DomainWithUsage":{"allOf":[{"$ref":"#/components/schemas/Domain"},{"type":"object","properties":{"endpoints":{"type":"array","items":{"$ref":"#/components/schemas/DomainEndpoint"}},"usage":{"type":"object","properties":{"deploymentUrlProjects":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"portalBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true},"hostname":{"type":"string"}},"required":["id","projectId","projectName","hostname"]}},"packageDomains":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"hostname":{"type":"string"}},"required":["id","hostname"]}},"managerBindings":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"managerId":{"type":"string"},"managerName":{"type":"string"},"hostname":{"type":"string"}},"required":["id","managerId","managerName","hostname"]}}},"required":["deploymentUrlProjects","portalBindings","packageDomains","managerBindings"]}},"required":["endpoints","usage"]}]},"Domain":{"type":"object","properties":{"id":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"domain":{"type":"string"},"isSystem":{"type":"boolean"},"claimToken":{"type":"string"},"hostedZoneId":{"type":"string","nullable":true},"nameServers":{"type":"array","nullable":true,"items":{"type":"string"}},"status":{"type":"string","enum":["pending-zone-creation","pending-verification","verified","lost-verification","failed","deleting"]},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verifiedAt":{"type":"string","format":"date-time","nullable":true}},"required":["id","workspaceId","domain","isSystem","claimToken","status","createdAt","updatedAt"]},"EventListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Event"},{"type":"object","properties":{"releaseCreatedAt":{"type":"string","format":"date-time","nullable":true,"description":"createdAt of the event's referenced release, included when ?include=releaseCreatedAt is used"}}}]},"IncidentListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Incident"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"],"additionalProperties":false},"Incident":{"type":"object","properties":{"id":{"type":"string"},"number":{"type":"integer","minimum":0,"exclusiveMinimum":true},"reference":{"type":"string"},"title":{"type":"string"},"scopeLabel":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true},"sessionStatus":{"type":"string","nullable":true,"enum":["queued","running","halted","complete","error","canceled",null]},"projectId":{"type":"string","nullable":true},"deploymentId":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","number","reference","title","scopeLabel","agentSessionId","sessionStatus","projectId","deploymentId","releaseId","createdAt","updatedAt"],"additionalProperties":false},"IncidentResponse":{"type":"object","properties":{"incident":{"$ref":"#/components/schemas/Incident"}},"required":["incident"],"additionalProperties":false},"ListMachinesJoinTokensResponse":{"type":"object","properties":{"tokens":{"type":"array","items":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"}}},"required":["tokens"]},"MachinesJoinTokenSummary":{"type":"object","properties":{"id":{"type":"string"},"createdAt":{"type":"string"},"createdBy":{"type":"string"},"expiresAt":{"type":"string","nullable":true},"maxJoins":{"type":"integer","nullable":true},"joinCount":{"type":"integer"},"lastUsedAt":{"type":"string","nullable":true},"revokedAt":{"type":"string","nullable":true}},"required":["id","createdAt","createdBy","joinCount"]},"CreateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RotateMachinesJoinTokenResponse":{"type":"object","properties":{"joinToken":{"type":"string"},"controlPlaneUrl":{"type":"string","format":"uri"},"clusterId":{"type":"string"},"token":{"$ref":"#/components/schemas/MachinesJoinTokenSummary"},"cliInstallScriptUrl":{"type":"string","nullable":true,"format":"uri","description":"Deploy CLI install script URL, or null when no ready CLI package exists."},"cliCommandName":{"type":"string","nullable":true,"description":"CLI command name to use in join instructions."}},"required":["joinToken","controlPlaneUrl","clusterId","token","cliInstallScriptUrl","cliCommandName"]},"RevokeMachinesJoinTokenResponse":{"type":"object","properties":{"tokenId":{"type":"string"},"revoked":{"type":"boolean"}},"required":["tokenId","revoked"]},"CancelMachinesMachineDrainResponse":{"type":"object","properties":{"machineId":{"type":"string"},"cancelled":{"type":"boolean"}},"required":["machineId","cancelled"]},"DrainMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"requested":{"type":"boolean"}},"required":["machineId","requested"]},"DrainMachinesMachineRequest":{"type":"object","properties":{"deadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"force":{"type":"boolean"}}},"RemoveMachinesMachineResponse":{"type":"object","properties":{"machineId":{"type":"string"},"removed":{"type":"boolean"}},"required":["machineId","removed"]},"CommandBootstrapResponse":{"type":"object","properties":{"managerUrl":{"type":"string","format":"uri","description":"Current customer-facing manager URL"},"token":{"type":"string","minLength":1,"description":"Short-lived command capability token"},"expiresAt":{"type":"string","format":"date-time","description":"Capability expiry in RFC 3339 format"},"target":{"$ref":"#/components/schemas/CommandReceiverBootstrapTarget"}},"required":["managerUrl","token","expiresAt"]},"CommandReceiverBootstrapTarget":{"type":"object","properties":{"resourceId":{"type":"string"},"resourceType":{"type":"string","enum":["container","daemon"]}},"required":["resourceId","resourceType"],"description":"Resolved target identity; present only for receiver bootstrap"},"CommandBootstrapRequest":{"oneOf":[{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["sender"]}},"required":["deploymentId","role"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"role":{"type":"string","enum":["receiver"]},"target":{"type":"string","minLength":1,"maxLength":255}},"required":["deploymentId","role","target"],"additionalProperties":false}]},"CommandListItemResponse":{"allOf":[{"$ref":"#/components/schemas/Command"},{"type":"object","properties":{"deployment":{"$ref":"#/components/schemas/CommandDeploymentInfo"},"project":{"$ref":"#/components/schemas/CommandProjectInfo"}}}]},"CommandVerification":{"type":"object","nullable":true,"properties":{"state":{"type":"string","enum":["not-required","pending","verified","failed","skipped"],"description":"Verification outcome of an operation command."},"reason":{"type":"string","nullable":true,"description":"Present for 'failed' and 'skipped'."}},"required":["state","reason"],"description":"Verification outcome of an operation command; null for commands that are not operations"},"CommandDeploymentInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/CommandDeploymentGroupInfo"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Platform-specific environment information"},"managerId":{"type":"string","description":"Manager ID for obtaining access tokens"},"managerUrl":{"type":"string","nullable":true,"format":"uri","description":"URL of the manager for direct payload access"},"managerName":{"type":"string","nullable":true,"description":"Human-readable name of the manager"},"managerIsSystem":{"type":"boolean","nullable":true,"description":"Whether the manager is Alien-hosted (system)"}},"required":["id","name","managerId"]},"CommandDeploymentGroupInfo":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"CommandProjectInfo":{"type":"object","properties":{"id":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"name":{"type":"string"}},"required":["id","name"]},"Command":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"name":{"type":"string","description":"Command name (e.g., 'analyze-repository', 'sync-data')"},"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Command states in the Commands protocol lifecycle"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Delivery mode for this command (push/pull), derived from the target at creation time"},"target":{"type":"object","nullable":true,"properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to; null on commands created before target routing"},"attempt":{"type":"number","nullable":true,"description":"Current attempt number"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","nullable":true,"description":"Size of command params in bytes"},"responseSizeBytes":{"type":"number","nullable":true,"description":"Size of command response in bytes"},"createdAt":{"type":"string","format":"date-time","description":"When the command was created"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command was dispatched to the deployment"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When the command completed"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if command failed"},"accessRequestId":{"type":"string","nullable":true,"description":"The approved access request that authorized this operation command, if one did"},"verification":{"$ref":"#/components/schemas/CommandVerification"},"result":{"nullable":true,"description":"Decoded command result when available"},"resultAvailability":{"type":"string","enum":["available","protected"],"description":"Whether a successful operation result is included or withheld pending explicit confirmation"}},"required":["id","deploymentId","projectId","workspaceId","name","state","deploymentModel","target","attempt","deadline","requestSizeBytes","responseSizeBytes","createdAt","dispatchedAt","completedAt","error","accessRequestId","verification"]},"ListCommandNamesResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}}},"required":["names"]},"ListCommandDeploymentsResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]}},"required":["id","name"]}}},"required":["deployments"]},"CreateCommandResponse":{"type":"object","properties":{"id":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"projectId":{"type":"string","description":"Project ID (for manager to use in routing)"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"How to dispatch the command"},"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Resource the command is addressed to"},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How the command is delivered to its target"},"operationResultContractPersisted":{"type":"boolean","description":"Whether an operation result contract was stored atomically with this command"}},"required":["id","projectId","deploymentModel","target","deliveryMode","operationResultContractPersisted"]},"CreateCommandRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Target deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":1,"maxLength":255,"description":"Command name (e.g., 'analyze-repository')"},"params":{"nullable":true,"description":"Command parameters for public invocation"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key for public invocation retries. Requires params; use null for a command without arguments. Reuse the same key and identical request to recover the original command for up to 24 hours. Scoped to the workspace, caller, deployment, resolved target, and command name. The first accepted request wins; changed params or deadlines do not create a new command with the same key. Omit for a new invocation without retry protection."},"target":{"type":"string","maxLength":255,"description":"Resource id the command is addressed to. Required when the deployment has more than one command-capable resource."},"initialState":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Initial state (PENDING_UPLOAD if params require upload, PENDING if inline)"},"deadline":{"type":"string","nullable":true,"format":"date-time","description":"Optional deadline for command execution"},"requestSizeBytes":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Size of command params in bytes"},"operationResultContract":{"nullable":true,"description":"Opaque operation result contract with an optional accessRequestId binding, forwarded by a manager and persisted atomically before dispatch"}},"required":["deploymentId","name"]},"ResolvedCommandTarget":{"type":"object","properties":{"target":{"type":"object","properties":{"resourceId":{"type":"string","description":"The resource ID within the deployment's stack (e.g. a Worker/Container/Daemon id)."},"resourceType":{"type":"string","enum":["worker","container","daemon"],"description":"The kind of command-capable resource a command targets."}},"required":["resourceId","resourceType"],"description":"Identifies the specific resource a command is addressed to."},"deliveryMode":{"type":"string","enum":["push","pull"],"description":"How a command is delivered to its target resource.\n\nThis is a Commands-protocol-specific concept and is intentionally distinct\nfrom `DeploymentModel` (see `stack_settings.rs`), which governs the\ninfrastructure-level push/pull wiring for a deployment. Serialized\nlowercase for consistency with `CommandTargetType`."}},"required":["target","deliveryMode"]},"UpdateCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"New command state"},"attempt":{"type":"number","minimum":0,"exclusiveMinimum":true,"description":"Current attempt number"},"dispatchedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command was dispatched"},"completedAt":{"type":"string","nullable":true,"format":"date-time","description":"When command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}}},"DispatchCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"DispatchCommandRequest":{"type":"object","properties":{"dispatchedAt":{"type":"string","format":"date-time","description":"When the command was dispatched"}},"required":["dispatchedAt"]},"CompleteCommandResponse":{"type":"object","properties":{"updated":{"type":"boolean","description":"Whether the command transitioned; false if it was already terminal"}},"required":["updated"]},"CompleteCommandRequest":{"type":"object","properties":{"state":{"type":"string","enum":["SUCCEEDED","FAILED","EXPIRED"],"description":"Terminal state to transition to"},"completedAt":{"type":"string","format":"date-time","description":"When the command completed"},"responseSizeBytes":{"type":"number","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Size of response in bytes"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Error details if failed"}},"required":["state","completedAt"]},"IncrementCommandAttemptResponse":{"type":"object","properties":{"attempt":{"type":"integer","description":"The attempt number after the increment"}},"required":["attempt"]},"DebugSessionListResponse":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DebugSession"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"},"DebugSession":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"owner":{"type":"string","nullable":true,"maxLength":128},"state":{"$ref":"#/components/schemas/DebugSessionState"},"mode":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"provider":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Represents the target cloud platform."},"presignedUrls":{"type":"object","additionalProperties":{"$ref":"#/components/schemas/DebugPackagePresignedURLs"}},"error":{"nullable":true},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"}},"required":["id","state","mode","presignedUrls","createdAt","expiresAt","deploymentId","projectId","workspaceId"]},"DebugSessionState":{"type":"string","enum":["pending","running","stopping","stopped","expired","failed"]},"DebugPackagePresignedURLs":{"type":"object","properties":{"readUrl":{"type":"string","maxLength":2048,"format":"uri"},"writeUrl":{"type":"string","maxLength":2048,"format":"uri"}},"required":["readUrl","writeUrl"]},"CreateDebugSessionRequest":{"type":"object","properties":{"id":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Override the generated id. Manager passes the registry session id so logs correlate.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"owner":{"type":"string","nullable":true,"maxLength":128},"expiresAt":{"type":"string","format":"date-time"},"state":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Initial state. Defaults to 'pending'."}]},"accessRequestId":{"type":"string","description":"The caller's own access request whose debug grant authorized this session, for the same deployment."}},"required":["deploymentId","expiresAt"]},"UpdateDebugSessionRequest":{"type":"object","properties":{"state":{"$ref":"#/components/schemas/DebugSessionState"},"error":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"expiresAt":{"type":"string","format":"date-time"}}},"DeploymentInfo":{"type":"object","properties":{"setupUpdate":{"type":"object","properties":{"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"releaseId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"}],"nullable":true},"setupMetadata":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMetadata"}],"nullable":true},"setupTarget":{"type":"string","nullable":true},"resourcePrefix":{"type":"string","nullable":true},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["deploymentId","updateOperationId","releaseId","name","platform","setupMethod","setupMetadata","setupTarget","resourcePrefix","stackSettings"]},"tokenType":{"type":"string","enum":["deployment","deployment-group"],"description":"Type of token used to authenticate this request"},"deployment":{"type":"object","properties":{"name":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}},"required":["name","platform"],"description":"Deployment details (present when using a deployment-scoped token)"},"deploymentGroup":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"pinnedSubdomain":{"type":"string","nullable":true}},"required":["id","name","pinnedSubdomain"],"description":"Deployment group details (present when using a deployment-group token)"},"workspace":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"avatarUrl":{"type":"string","nullable":true,"format":"uri"}},"required":["id","name"]},"project":{"type":"object","properties":{"name":{"type":"string"},"portal":{"type":"object","properties":{"appearance":{"$ref":"#/components/schemas/DeploymentPortalAppearance"}},"required":["appearance"]},"stackSummary":{"type":"object","nullable":true,"properties":{"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms supported by the active release"},"requiresNetwork":{"type":"boolean","description":"Whether the stack contains resources that require cloud VPC networking"},"customerModels":{"type":"boolean","description":"Whether this release offers one remotely accessible AI resource"},"resourceCounts":{"type":"object","properties":{"workers":{"type":"integer","minimum":0},"containers":{"type":"integer","minimum":0},"daemons":{"type":"integer","minimum":0,"description":"Daemon resources that run on managed runtime machines"},"publicHttpsEndpoints":{"type":"integer","minimum":0,"description":"Resources that declare managed public HTTPS endpoint setup"},"externalInfra":{"type":"integer","minimum":0,"description":"Storage, queue, KV, vault, database, or cache resources that Kubernetes needs Terraform to provision"},"total":{"type":"integer","minimum":0}},"required":["workers","containers","publicHttpsEndpoints","externalInfra","total"]},"publicEndpoints":{"type":"array","items":{"type":"object","properties":{"resourceId":{"type":"string"},"endpointName":{"type":"string"},"hostLabel":{"type":"string"},"wildcardSubdomains":{"type":"boolean"}},"required":["resourceId","endpointName","hostLabel","wildcardSubdomains"]},"description":"Public endpoints declared by the active release stack"}},"required":["platforms","requiresNetwork","customerModels","resourceCounts","publicEndpoints"]},"generatedDomain":{"type":"object","nullable":true,"properties":{"domain":{"type":"string"},"isSystem":{"type":"boolean"}},"required":["domain","isSystem"],"description":"Parent domain for generated deployment URLs. Chosen public subdomains are only allowed when isSystem is false."}},"required":["name","portal"]},"packages":{"type":"object","properties":{"ready":{"type":"boolean","description":"True if all enabled packages are ready for deployment"},"cli":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"commandName":{"type":"string","description":"CLI command name to use in install instructions"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"binaries":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA256 checksum"},"size":{"type":"integer","minimum":0,"description":"File size in bytes"},"url":{"type":"string","description":"Download URL for the binary"}},"required":["sha256","size","url"],"description":"Information about a single binary artifact"},"description":"Binary information for each target platform"},"buildInfo":{"type":"object","properties":{"alienSha":{"type":"string","description":"Alien source commit used to build the source CLI and agent binaries."},"horizonSha":{"type":"string","description":"Compute backend source revision used by optional package extensions, if applicable."},"machineBundleManifestUrl":{"type":"string","nullable":true,"description":"Machine runtime release manifest embedded into the generated CLI."},"platformSha":{"type":"string","description":"Source revision used to build the package service and optional extensions."},"sourceAgentBinarySha256":{"type":"string","nullable":true,"description":"SHA256 checksum of the source runtime helper binary shipped with the CLI package, when present."},"sourceCliBinarySha256":{"type":"string","description":"SHA256 checksum of the source deploy CLI binary before white-label config is appended."}},"required":["alienSha","horizonSha","platformSha","sourceCliBinarySha256"],"description":"Source provenance for a generated CLI package."}},"required":["binaries","buildInfo"],"description":"Outputs from a CLI package build"},"error":{"nullable":true},"installScripts":{"type":"object","properties":{"windows":{"type":"string","format":"uri"},"mac":{"type":"string","format":"uri"},"linux":{"type":"string","format":"uri"}},"required":["windows","mac","linux"],"description":"Install script URLs for each OS"}},"required":["status","commandName","installScripts"]},"cloudformation":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"targets":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"launchStackUrl":{"type":"string","description":"AWS Console quick-launch URL"},"sha256":{"type":"string","description":"SHA256 checksum of the template"},"size":{"type":"integer","minimum":0,"description":"Template size in bytes"},"stackPolicyUrl":{"type":"string","description":"S3 URL to the CloudFormation stack policy"},"target":{"type":"string","description":"CloudFormation target (aws, eks)"},"templateUrl":{"type":"string","description":"S3 URL to the CloudFormation template"}},"required":["launchStackUrl","sha256","size","stackPolicyUrl","target","templateUrl"],"description":"Information about a single CloudFormation template package for one target."},"description":"Template artifacts by CloudFormation target."}},"required":["targets"],"description":"Outputs from a CloudFormation package build."},"error":{"nullable":true},"mode":{"type":"string","enum":["auto","outputs"]},"launchUrl":{"type":"string","format":"uri","description":"CloudFormation launch URL"},"outputsSchema":{"nullable":true}},"required":["status","mode","launchUrl"]},"terraform":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"modules":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the module archive"},"filename":{"type":"string","description":"Filename of the module archive"},"shasum":{"type":"string","description":"SHA256 checksum of the archive"},"size":{"type":"integer","minimum":0,"description":"Size of the archive in bytes"},"source":{"type":"string","description":"Terraform module source (hostname/namespace/name/provider, without scheme)"},"target":{"type":"string","description":"Terraform module target (aws, gcp, azure, eks, gke, aks)"},"variables":{"type":"array","items":{"type":"string"},"description":"Terraform input variables exposed by this module."}},"required":["downloadUrl","filename","shasum","size","source","target"],"description":"Information about a single Terraform module package for one target."},"description":"Module registry artifacts by Terraform target."},"provider":{"type":"object","properties":{"gpgPublicKey":{"type":"object","properties":{"asciiArmor":{"type":"string","description":"ASCII-armored public key"},"keyId":{"type":"string","description":"GPG key ID"}},"required":["asciiArmor","keyId"],"description":"GPG public key for Terraform provider signature verification"},"platforms":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"downloadUrl":{"type":"string","description":"Download URL for the provider zip"},"filename":{"type":"string","description":"Filename of the provider zip"},"shasum":{"type":"string","description":"SHA256 checksum of the zip file"},"shasumsSignatureUrl":{"type":"string","description":"URL to the shasums signature file"},"shasumsUrl":{"type":"string","description":"URL to the shasums file"},"size":{"type":"integer","minimum":0,"description":"Size of the zip file in bytes"}},"required":["downloadUrl","filename","shasum","shasumsSignatureUrl","shasumsUrl","size"],"description":"Information about a single Terraform provider package for a specific platform"},"description":"Provider packages for each target platform"},"source":{"type":"string","description":"Terraform provider source (hostname/namespace/type, without scheme)"}},"required":["gpgPublicKey","platforms","source"],"description":"Terraform provider registry outputs."}},"required":["modules","provider"],"description":"Outputs from a Terraform package build."},"error":{"nullable":true},"providerSource":{"type":"string","description":"Terraform provider source (without https://)"},"moduleSources":{"type":"object","additionalProperties":{"type":"string"},"description":"Terraform module sources by target"},"moduleVersion":{"type":"string"},"managerUrls":{"type":"object","additionalProperties":{"type":"string"},"description":"Manager URLs by Terraform target"}},"required":["status","providerSource","moduleSources","managerUrls"]},"helm":{"type":"object","properties":{"status":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Status of a package build"},"version":{"type":"string"},"outputs":{"type":"object","properties":{"chart":{"type":"string","description":"OCI chart reference (e.g., \"oci://public.ecr.aws/acme/charts/project-id\")"},"managerUrl":{"type":"string","description":"Default management endpoint embedded in this chart, if available."},"version":{"type":"string","description":"Chart version (e.g., \"1.2.3\")"}},"required":["chart","version"],"description":"Outputs from a Helm chart package build"},"error":{"nullable":true},"chartRef":{"type":"string","description":"OCI chart reference"},"managerUrlOverride":{"type":"string","format":"uri","description":"Management endpoint to supply only when this chart's captured default differs from current installation routing."},"managerFetchExample":{"type":"string"},"localImportExample":{"type":"string"}},"required":["status","chartRef"]}},"required":["ready"]},"installContext":{"type":"object","properties":{"targets":{"type":"object","additionalProperties":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managerUrl":{"type":"string","format":"uri"},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"awsManagingAccountId":{"type":"string"}},"required":["platform","managerUrl"]},"description":"Deployment-session install context by Terraform/installer target"}},"required":["targets"]},"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"},"modelAvailabilitySources":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"status":{"type":"string","enum":["current","stale","invalid"]},"availability":{"$ref":"#/components/schemas/AiAvailabilityObservation"}},"required":["deploymentId","resourceId","observedAt","status"]}},"setupItems":{"type":"array","items":{"$ref":"#/components/schemas/SetupItemStatus"}},"setupConfig":{"$ref":"#/components/schemas/DeploymentInfoSetupConfig"},"readiness":{"type":"object","properties":{"status":{"type":"string","enum":["ready","notReady","unknown"]},"checks":{"type":"array","items":{"type":"object","properties":{"code":{"type":"string"},"status":{"type":"string","enum":["passed","failed","warning","unknown"]},"message":{"type":"string"},"checkedAt":{"type":"string"}},"required":["code","status","message","checkedAt"]}}},"required":["status","checks"]}},"required":["tokenType","workspace","project","packages","installContext","supportedRegions","modelAvailabilitySources"]},"DeploymentPortalAppearance":{"type":"object","properties":{"avatarUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional project-specific avatar override for the deployment portal."},"preset":{"$ref":"#/components/schemas/DeploymentPortalAppearancePreset"},"accentColor":{"$ref":"#/components/schemas/DeploymentPortalAccentColor"},"title":{"type":"string","nullable":true,"maxLength":80,"description":"Optional portal title. Defaults to the project name."},"subtitle":{"type":"string","nullable":true,"maxLength":160,"description":"Optional customer-facing subtitle."},"supportUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional support or contact URL."},"docsUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri","description":"Optional documentation URL."},"density":{"$ref":"#/components/schemas/DeploymentPortalDensity"}}},"SupportedCloudRegions":{"type":"object","properties":{"aws":{"type":"array","items":{"type":"string"},"description":"AWS regions supported by this Alien environment."},"gcp":{"type":"array","items":{"type":"string"},"description":"GCP regions supported by this Alien environment."},"azure":{"type":"array","items":{"type":"string"},"description":"Azure locations supported by this Alien environment."}},"required":["aws","gcp","azure"]},"AiAvailabilityObservation":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"SetupItemStatus":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false},"status":{"type":"string","enum":["not-started","waiting","applying","verifying","connected","needs-attention","revoked"]},"deploymentIds":{"type":"array","items":{"type":"string"}},"blocker":{"type":"object","properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]}},"required":["item","source","required","status","deploymentIds"],"additionalProperties":false},"DeploymentInfoSetupConfig":{"type":"object","properties":{"metadata":{"$ref":"#/components/schemas/DeploymentSetupMetadata"},"policy":{"$ref":"#/components/schemas/DeploymentSetupPolicy"},"environmentVariables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","pattern":"^[A-Z_][A-Z0-9_]*$","description":"Variable name"},"type":{"$ref":"#/components/schemas/EnvironmentVariableType"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string","pattern":"^[a-zA-Z0-9_-]+(\\*)?$"},"description":"Target resource patterns (null = all resources, array = wildcard patterns)"}},"required":["name","type","targetResources"]}},"items":{"type":"array","items":{"type":"object","properties":{"item":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"source":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["project-release"]},"releaseChannel":{"type":"string","minLength":1,"maxLength":63},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"resourceId":{"type":"string","minLength":1,"maxLength":256}},"required":["type","releaseChannel","releaseId"],"additionalProperties":false},{"type":"object","properties":{"type":{"type":"string","enum":["built-in"]},"definitionId":{"type":"string","enum":["customer-ai","customer-key","customer-storage","customer-registry","customer-sandbox"]},"version":{"type":"string","minLength":1,"maxLength":64},"sourceReleaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["type","definitionId","version","sourceReleaseId"],"additionalProperties":false}]},"required":{"type":"boolean"},"configuration":{"type":"object","properties":{"allowedProviders":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"maxItems":6},"providerAllowlist":{"type":"array","items":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic","databricks","openai"]},"minItems":1,"maxItems":6},"modelRequirements":{"type":"array","items":{"type":"object","properties":{"publicModelId":{"type":"string","minLength":1,"maxLength":256},"clientApis":{"type":"array","items":{"type":"string","enum":["openai-chat","openai-responses","anthropic-messages"]},"minItems":1,"maxItems":3},"required":{"type":"boolean"}},"required":["publicModelId","clientApis","required"],"additionalProperties":false},"maxItems":100}},"additionalProperties":false}},"required":["item","source","required"],"additionalProperties":false},"maxItems":8},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."}},"inputValues":{"type":"array","items":{"$ref":"#/components/schemas/ResolvedStackInputSummary"}}},"required":["metadata","policy","environmentVariables"]},"ResolvedStackInputSummary":{"type":"object","properties":{"id":{"type":"string"},"label":{"type":"string"},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"]}},"required":{"type":"boolean"},"secret":{"type":"boolean"},"provided":{"type":"boolean"}},"required":["id","label","providedBy","required","secret","provided"]},"DeploymentComputePlan":{"type":"object","properties":{"pools":{"type":"array","items":{"type":"object","properties":{"poolId":{"type":"string"},"workloads":{"type":"array","items":{"type":"string"}},"requirements":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"scale":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["fixed"]},"machines":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","machines"]},{"type":"object","properties":{"type":{"type":"string","enum":["autoscale"]},"min":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]},"max":{"type":"object","properties":{"min":{"type":"integer","minimum":0},"max":{"type":"integer","minimum":0},"default":{"type":"integer","minimum":0}},"required":["min","max","default"]}},"required":["type","min","max"]}]},"selected":{"$ref":"#/components/schemas/ComputePoolSelection"},"recommended":{"$ref":"#/components/schemas/ComputePoolSelection"},"machines":{"type":"array","items":{"type":"object","properties":{"machine":{"type":"string"},"profile":{"type":"object","properties":{"cpu":{"type":"string"},"memoryBytes":{"type":"integer","minimum":0},"ephemeralStorageBytes":{"type":"integer","minimum":0},"architecture":{"type":"string","nullable":true,"enum":["arm64","x86_64",null]},"gpu":{"type":"object","nullable":true,"properties":{"type":{"type":"string"},"count":{"type":"integer","minimum":0}},"required":["type","count"]}},"required":["cpu","memoryBytes","ephemeralStorageBytes"]},"recommended":{"type":"boolean"}},"required":["machine","profile","recommended"]}},"errors":{"type":"array","items":{"type":"string"}}},"required":["poolId","workloads","requirements","scale","selected","recommended","machines"]}}},"required":["pools"]},"ComputePoolSelection":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"PreparedDeploymentStack":{"type":"object","properties":{"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"setup":{"$ref":"#/components/schemas/SetupFingerprintInfo"}},"required":["platform","stack","setup"]},"SlackInstallUrlResponse":{"type":"object","properties":{"url":{"type":"string","format":"uri"}},"required":["url"]},"SlackIntegrationStatus":{"type":"object","properties":{"connected":{"type":"boolean"},"slackTeamId":{"type":"string","nullable":true},"slackTeamName":{"type":"string","nullable":true},"installedByUserId":{"type":"string","nullable":true},"installedAt":{"type":"string","nullable":true},"notificationChannelId":{"type":"string","nullable":true}},"required":["connected","slackTeamId","slackTeamName","installedByUserId","installedAt","notificationChannelId"]},"SlackChannelsResponse":{"type":"object","properties":{"channels":{"type":"array","items":{"$ref":"#/components/schemas/SlackChannel"}}},"required":["channels"]},"SlackChannel":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"isMember":{"type":"boolean"}},"required":["id","name","isMember"]},"SlackNotificationChannelResponse":{"type":"object","properties":{"notificationChannelId":{"type":"string","nullable":true},"warning":{"type":"string","nullable":true}},"required":["notificationChannelId","warning"]},"SlackNotificationChannelRequest":{"type":"object","properties":{"channelId":{"type":"string","nullable":true}},"required":["channelId"]},"AgentSessionListResponse":{"type":"object","properties":{"sessions":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionListItem"}}},"required":["sessions"]},"AgentSessionListItem":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"subjectId":{"type":"string"},"subject":{"$ref":"#/components/schemas/AgentSessionSubject"},"status":{"type":"string"},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","triggerType","subjectId","subject","status","createdAt","updatedAt"]},"AgentSessionSubject":{"type":"object","properties":{"deploymentName":{"type":"string","nullable":true},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"releaseId":{"type":"string","nullable":true},"releaseCommitMessage":{"type":"string","nullable":true},"releaseCommitRef":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"projectName":{"type":"string","nullable":true}},"required":["deploymentName","deploymentGroupId","deploymentGroupName","releaseId","releaseCommitMessage","releaseCommitRef","projectId","projectName"]},"AgentSessionDetail":{"allOf":[{"$ref":"#/components/schemas/AgentSessionListItem"},{"type":"object","properties":{"resultText":{"type":"string","nullable":true},"toolNames":{"type":"array","nullable":true,"items":{"type":"string"}},"error":{"type":"string","nullable":true}},"required":["resultText","toolNames","error"]}]},"AgentSessionEventsResponse":{"type":"object","properties":{"events":{"type":"array","items":{"$ref":"#/components/schemas/AgentSessionEvent"}},"latestSeq":{"type":"number"},"hasMore":{"type":"boolean"}},"required":["events","latestSeq","hasMore"]},"AgentSessionEvent":{"oneOf":[{"$ref":"#/components/schemas/AgentSessionStatusEvent"},{"$ref":"#/components/schemas/AgentSessionStepEvent"},{"$ref":"#/components/schemas/AgentSessionToolCallEvent"},{"$ref":"#/components/schemas/AgentSessionToolResultEvent"},{"$ref":"#/components/schemas/AgentSessionMarkdownEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalRequestedEvent"},{"$ref":"#/components/schemas/AgentSessionApprovalGrantedEvent"},{"$ref":"#/components/schemas/AgentSessionRestartedEvent"},{"$ref":"#/components/schemas/AgentSessionEventsTruncatedEvent"}],"discriminator":{"propertyName":"type","mapping":{"status":"#/components/schemas/AgentSessionStatusEvent","step":"#/components/schemas/AgentSessionStepEvent","tool_call":"#/components/schemas/AgentSessionToolCallEvent","tool_result":"#/components/schemas/AgentSessionToolResultEvent","markdown":"#/components/schemas/AgentSessionMarkdownEvent","approval_requested":"#/components/schemas/AgentSessionApprovalRequestedEvent","approval_granted":"#/components/schemas/AgentSessionApprovalGrantedEvent","session_restarted":"#/components/schemas/AgentSessionRestartedEvent","events_truncated":"#/components/schemas/AgentSessionEventsTruncatedEvent"}}},"AgentSessionStatusEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["status"]},"payload":{"type":"object","properties":{"status":{"type":"string"},"error":{"type":"string"}},"required":["status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStepEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["step"]},"payload":{"type":"object","properties":{"stepId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["in_progress","complete","error"]}},"required":["stepId","title","status"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolCallEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionToolResultEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["tool_result"]},"payload":{"type":"object","properties":{"toolCallId":{"type":"string","nullable":true},"toolName":{"type":"string","nullable":true},"ok":{"type":"boolean"},"output":{"nullable":true}},"required":["toolCallId","toolName","ok"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionMarkdownEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["markdown"]},"payload":{"type":"object","properties":{"text":{"type":"string"}},"required":["text"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalRequestedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_requested"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"toolCallId":{"type":"string"},"toolName":{"type":"string"},"input":{"nullable":true}},"required":["approvalId","toolCallId","toolName"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionApprovalGrantedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["approval_granted"]},"payload":{"type":"object","properties":{"approvalId":{"type":"string"},"approvedByUserId":{"type":"string"},"approvedByName":{"type":"string","nullable":true},"source":{"type":"string","enum":["dashboard","slack"]}},"required":["approvalId","approvedByUserId","approvedByName","source"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionRestartedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["session_restarted"]},"payload":{"type":"object","properties":{"reason":{"type":"string"}},"required":["reason"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionEventsTruncatedEvent":{"type":"object","properties":{"seq":{"type":"number"},"createdAt":{"type":"string"},"type":{"type":"string","enum":["events_truncated"]},"payload":{"type":"object","properties":{"limit":{"type":"number"}},"required":["limit"]}},"required":["seq","createdAt","type","payload"]},"AgentSessionStopResponse":{"type":"object","properties":{"jobId":{"type":"string"},"status":{"type":"string"},"canceled":{"type":"boolean"}},"required":["jobId","status","canceled"]},"ListOperationsPluginsResponse":{"type":"object","properties":{"plugins":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPlugin"}},"installations":{"$ref":"#/components/schemas/OperatorInstallationsRollup"}},"required":["plugins","installations"]},"OperationsPlugin":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default tier."},"builtin":{"type":"boolean","description":"True for compiled-in plugins, false for custom bundles."},"enabled":{"type":"boolean"},"operations":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPluginOperation"}}},"required":["name","version","tier","builtin","enabled","operations"]},"OperationsPluginOperation":{"type":"object","properties":{"name":{"type":"string","description":"Operation name, unique within the plugin."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Effective risk tier for this operation."},"description":{"type":"string","nullable":true,"description":"Human-readable description."},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for operation parameters when the plugin publishes one."},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"JSON Schema for a successful result when the plugin publishes one."},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string"},"pollOperation":{"type":"string"},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string"}},"successField":{"type":"string"},"successValue":{"type":"string"},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer","minimum":1},"intervalSeconds":{"type":"integer","minimum":0}},"required":["maxAttempts","intervalSeconds"]},"timeoutSeconds":{"type":"integer","minimum":1}},"required":["changes","pollOperation","pollParamsFromResult","successField","successValue","timeoutSeconds"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"requiredPermissions":{"type":"array","items":{"type":"string"},"description":"IDs of permission sets (see alien-permissions) this operation requires. Empty when the operation declares none."},"permissions":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetesPermissions":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["name","tier","description","inputSchema","outputSchema","timeoutSeconds","retries","verification","sensitiveOutput","requiredPermissions","permissions"]},"OperatorInstallationsRollup":{"type":"object","properties":{"total":{"type":"integer","minimum":0,"description":"Total pull-mode installations tracked."},"ready":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["total","ready","syncing","stuck"],"description":"Rollup of this project's pull-mode installations by operations-bundle sync status, reflecting the currently enabled plugin set."},"SetBuiltinOperationsPluginsResponse":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"}},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["names","permissionDiff"]},"OperationsPermissionDiff":{"type":"object","properties":{"aws":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change adds."},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsAwsPermissionDiffStatement"},"description":"IAM statements this change removes from the generated cloud configuration."}},"required":["added","removed"]},"gcp":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsGcpPermissionDiffGrant"}}},"required":["added","removed"]},"kubernetes":{"type":"object","properties":{"added":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}},"removed":{"type":"array","items":{"$ref":"#/components/schemas/OperationsKubernetesPermissionDiffGrant"}}},"required":["added","removed"]},"incompleteForPlugins":{"type":"array","items":{"type":"string"},"description":"Previously enabled plugins whose grants could not be read before this change disabled or replaced them. Added and removed grants may be incomplete; inspect existing cloud policies before applying the regenerated configuration."}},"required":["aws","gcp","kubernetes"],"description":"Cloud permission delta versus the previously enabled set."},"OperationsAwsPermissionDiffStatement":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["effect","actions","resources","condition","sources"]},"OperationsPermissionDiffSource":{"type":"object","properties":{"plugin":{"type":"string","description":"Plugin that declared the permission."},"operation":{"type":"string","description":"Operation that declared the permission."},"reason":{"type":"string","description":"Why the operation needs this permission."}},"required":["plugin","operation","reason"]},"OperationsGcpPermissionDiffGrant":{"type":"object","properties":{"permission":{"type":"string"},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"],"description":"Where setup grants the permission: the configured project, or each Cloud Storage bucket the installer lists."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["permission","scope","sources"]},"OperationsKubernetesPermissionDiffGrant":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"type":"string"}},"resourceNames":{"type":"array","items":{"type":"string"},"description":"Empty means every resource name."},"remediationOnly":{"type":"boolean","description":"True for write verbs. The Helm chart renders them only when Operator permission is set to remediation; diagnostics installs omit them."},"sources":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPermissionDiffSource"}}},"required":["apiGroup","resource","verbs","resourceNames","remediationOnly","sources"]},"SetBuiltinOperationsPluginsRequest":{"type":"object","properties":{"names":{"type":"array","items":{"type":"string"},"description":"Complete set of built-in plugins to enable."}},"required":["names"],"additionalProperties":false},"OperationsBundleUploadUrlResponse":{"type":"object","properties":{"uploadUrl":{"type":"string","format":"uri","description":"Presigned S3 PUT URL to upload the bundle ZIP to."},"uploadId":{"type":"string","description":"One-time id for this upload. Pass it back verbatim to POST /plugins so the API can validate and snapshot exactly the bytes this call uploaded."},"contentType":{"type":"string","description":"Content-Type header the PUT must send (must match the signature)."}},"required":["uploadUrl","uploadId","contentType"]},"OperationsBundleUploadUrlRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."}},"required":["name"]},"PublishOperationsPluginResponse":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","version","tier","enabled","permissionDiff"]},"PublishOperationsPluginRequest":{"type":"object","properties":{"name":{"type":"string","minLength":1,"description":"Plugin name (from the bundle's metadata.json)."},"version":{"type":"string","minLength":1,"description":"Plugin version."},"uploadId":{"type":"string","minLength":1,"description":"The uploadId returned by POST /plugins/upload-url for the ZIP just uploaded. Identifies the exact S3 object to publish — never derived from name/version, so it can't collide with any other upload."},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Plugin-level default risk tier."},"metadata":{"type":"object","properties":{"name":{"type":"string","minLength":1},"version":{"type":"string","minLength":1},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"default":"destructive"},"binaries":{"oneOf":[{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["amd64"],"additionalProperties":false},{"type":"object","properties":{"amd64":{"type":"string","minLength":1,"maxLength":255},"arm64":{"type":"string","minLength":1,"maxLength":255}},"required":["arm64"],"additionalProperties":false}]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","minLength":1},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"description":{"type":"string","nullable":true,"minLength":1},"inputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"paramsSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"outputSchema":{"type":"object","nullable":true,"additionalProperties":{"nullable":true}},"permissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"requiredPermissions":{"type":"array","items":{"oneOf":[{"type":"string","minLength":1},{"type":"object","properties":{"id":{"type":"string","minLength":1},"description":{"type":"string","minLength":1},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"effect":{"type":"string","enum":["Allow","Deny"]},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}}},"required":["resources"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"},"condition":{"type":"object","nullable":true,"properties":{"title":{"type":"string"},"expression":{"type":"string"}},"required":["title","expression"],"additionalProperties":false}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"label":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"}},"permissions":{"type":"array","nullable":true,"items":{"type":"string"}},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"}},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"}},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"}}},"additionalProperties":false},"binding":{"type":"object","properties":{"stack":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false},"resource":{"type":"object","nullable":true,"properties":{"scope":{"type":"string"}},"required":["scope"],"additionalProperties":false}},"additionalProperties":false}},"required":["grant","binding"],"additionalProperties":false}}},"additionalProperties":false}},"required":["id","description","platforms"],"additionalProperties":false}]}},"timeoutSeconds":{"type":"integer","nullable":true,"minimum":1,"maximum":4294967295},"retries":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"verification":{"type":"object","nullable":true,"properties":{"changes":{"type":"string","minLength":1,"description":"Human-readable: what this operation changes."},"pollOperation":{"type":"string","minLength":1,"description":"A read-only operation in the same plugin to poll for success."},"pollParamsFromResult":{"type":"object","additionalProperties":{"type":"string","minLength":1},"default":{},"description":"Poll operation param name -> field name in the write operation's own result."},"successField":{"type":"string","minLength":1,"description":"Dotted field path in the poll result that signals success."},"successValue":{"type":"string","minLength":1,"description":"The value at successField that means verified."},"retry":{"type":"object","nullable":true,"properties":{"maxAttempts":{"type":"integer","minimum":1,"maximum":4294967295},"intervalSeconds":{"type":"integer","minimum":0,"maximum":4294967295}},"required":["maxAttempts","intervalSeconds"],"additionalProperties":false},"timeoutSeconds":{"type":"integer","minimum":1,"maximum":4294967295}},"required":["changes","pollOperation","successField","successValue","timeoutSeconds"],"additionalProperties":false},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string","minLength":1},"minItems":1}},"required":["kind","fields"],"additionalProperties":false},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"],"additionalProperties":false}]},"kubernetesPermissions":{"$ref":"#/components/schemas/KubernetesPermissions"}},"required":["name","permissions"],"additionalProperties":false},"default":[]}},"required":["name","version","binaries"],"additionalProperties":false,"description":"The complete canonical metadata.json from the uploaded bundle."}},"required":["name","version","uploadId","tier","metadata"]},"KubernetesPermissions":{"type":"object","properties":{"schemaVersion":{"type":"number","enum":[1]},"rules":{"type":"array","items":{"$ref":"#/components/schemas/Rule"},"minItems":1}},"required":["schemaVersion","rules"],"additionalProperties":false},"Rule":{"type":"object","properties":{"apiGroup":{"type":"string"},"resource":{"type":"string"},"verbs":{"type":"array","items":{"$ref":"#/components/schemas/Verb"},"minItems":1},"resourceNames":{"type":"array","items":{"type":"string"},"default":[]},"reason":{"type":"string","minLength":1}},"required":["apiGroup","resource","verbs","reason"],"additionalProperties":false},"Verb":{"type":"string","enum":["get","list","watch","delete","patch"]},"SetOperationsPluginEnabledResponse":{"type":"object","properties":{"name":{"type":"string"},"builtin":{"type":"boolean"},"enabled":{"type":"boolean"},"permissionDiff":{"$ref":"#/components/schemas/OperationsPermissionDiff"}},"required":["name","builtin","enabled","permissionDiff"]},"SetOperationsPluginEnabledRequest":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether the plugin is distributed to this project's Operators."},"dryRun":{"type":"boolean","description":"Validate the change and return its permission delta without saving it. Defaults to false."},"expectedPermissionDiff":{"allOf":[{"$ref":"#/components/schemas/OperationsPermissionDiff"},{"description":"The permission delta the caller reviewed, usually from a dry run. When set, the change is rejected with 409 if the current delta differs."}]}},"required":["enabled"]},"OperationsPolicyResponse":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"}},"default":{"type":"string","enum":["auto","manual"],"description":"Decision for commands no rule matches."}},"required":["rules","default"]},"OperationsPolicyRule":{"type":"object","properties":{"pattern":{"type":"string","description":"`plugin/operation`, `plugin/*`, or `*`."},"decision":{"type":"string","enum":["auto","manual"],"description":"auto: run immediately. manual: needs customer approval before running."},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"For a wildcard pattern (`plugin/*` or `*`) only: the highest risk tier a WILDCARD ACCESS REQUEST against this pattern may cover. Null/absent means no wildcard grant above read-only is allowed for this pattern — write and destructive wildcards require an explicit rule setting this field. Ignored for exact `plugin/operation` rules (a named operation's risk is already its own declared tier) and for the auto/manual invoke decision itself."}},"required":["pattern","decision"]},"UpdateOperationsPolicyRequest":{"type":"object","properties":{"rules":{"type":"array","items":{"$ref":"#/components/schemas/OperationsPolicyRule"},"description":"The full rule set (replaces the previous one)."}},"required":["rules"]},"InvokeOperationResponse":{"type":"object","properties":{"plugin":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"The operation's declared risk tier (informational)."},"decision":{"type":"string","enum":["auto","manual"],"description":"The approval decision the policy resolved to."},"status":{"type":"string","enum":["dispatched","pending-approval"],"description":"dispatched: auto-approved and running. pending-approval: needs customer sign-off."},"commandId":{"type":"string","description":"The created operation-command id when dispatched (absent when pending)."}},"required":["plugin","operation","tier","decision","status"]},"InvokeOperationRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment to run the operation against."},"plugin":{"type":"string","description":"Plugin name."},"operation":{"type":"string","description":"Operation name exposed by the plugin."},"params":{"nullable":true,"description":"JSON params passed to the operation."},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128,"description":"Stable caller key used to deduplicate this exact target operation."},"remediationPlanId":{"type":"string","description":"A remediation plan (`plan_…`) whose access request the customer has already approved for this exact command. When set and the plan's access request was created by the caller, is `customer-approved` and lists this `plugin/operation` with these params, the invocation is authorized by that approval and dispatches immediately regardless of the project's operations policy — the customer already signed off on this exact command via the access-request flow, so the project's default `manual` policy (meant for ad-hoc, unreviewed invocations) would otherwise require a second, redundant approval for the same action. Another principal's approved request never authorizes the caller."},"accessRequestId":{"type":"string","description":"A CLI-originated access request (`accessRequest_…`, no remediation plan) the caller created and the customer has already approved covering this exact command — either an exact match or a resolved, frozen wildcard entry. Same bypass semantics as `remediationPlanId`, for requests with no investigation behind them. Set exactly one of `remediationPlanId` or `accessRequestId`, not both. With neither, any approved request the caller created covering this exact command is used."}},"required":["deploymentId","plugin","operation"]},"VerifyOperationCheckResponse":{"type":"object","properties":{"outcome":{"type":"string","enum":["verified","not-yet","failed","skipped"],"description":"verified: success condition met. not-yet: keep polling. failed: the poll operation itself reported failure. skipped: the operation has no verification spec, or the write result carries none of the fields verification needs (the caller never opted in for this invocation)."},"reason":{"type":"string","description":"Present for 'failed' and 'skipped'."},"retry":{"type":"object","properties":{"maxAttempts":{"type":"integer"},"intervalSeconds":{"type":"integer"}},"required":["maxAttempts","intervalSeconds"],"description":"The operation's declared retry policy, echoed so the caller's poll loop doesn't need its own copy."},"timeoutSeconds":{"type":"integer","description":"The operation's declared verification timeout."}},"required":["outcome"]},"VerifyOperationCheckRequest":{"type":"object","properties":{"deploymentId":{"type":"string","description":"Deployment the original write command ran against."},"commandId":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Original operation command whose stored result and dispatch-time verification contract are authoritative.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"}},"required":["deploymentId","commandId"]},"AccessRequestDebugGrant":{"type":"object","nullable":true,"properties":{"tool":{"$ref":"#/components/schemas/DebugGrantTool"},"namespace":{"type":"string","example":"braintrust"},"cloudScope":{"type":"string","example":"123456789012/prod-readonly"}},"required":["tool"]},"DebugGrantTool":{"type":"string","enum":["kubectl","aws","gcloud","az"]},"AccessRequestStatus":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"CreateAccessRequest":{"type":"object","properties":{"replayKey":{"type":"string","minLength":1,"maxLength":128,"description":"Durable replay key scoped to the authenticated requester and workspace. Reusing it with a different validated payload returns ACCESS_REQUEST_REPLAY_MISMATCH."},"requestedExpiresAt":{"type":"string","format":"date-time","description":"Absolute requester deadline in UTC (Z suffix). Must be in the future and at most six hours ahead (30 seconds clock-skew tolerance). Approvals never extend it. Omit for legacy approval-window behavior."},"deploymentId":{"type":"string"},"remediationPlanId":{"type":"string","description":"Set for a plan-backed (ai-agent) request. Omit for a plan-less (CLI) request."},"title":{"type":"string","description":"Required for a plan-backed request; defaults to the operation/pattern/debug-tool for a plan-less one."},"reason":{"type":"string"},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]},"minItems":1,"description":"Plan-backed only: the exact commands the investigation is requesting."},"operation":{"type":"string","example":"kubernetes/restart-pod","description":"Plan-less, exact request: a single `plugin/operation`."},"operationPattern":{"type":"string","example":"kubernetes/*","description":"Plan-less, wildcard request: `plugin/*`. Requires `maxRisk`."},"params":{"nullable":true,"description":"Params for an exact `operation` request."},"maxRisk":{"type":"string","enum":["read-only","mutating","destructive"],"description":"Required with `operationPattern`: the highest risk tier the wildcard grant may cover."},"debugTool":{"allOf":[{"$ref":"#/components/schemas/DebugGrantTool"},{"description":"Requests a remote-debugging grant for this tool, alongside or instead of an operations grant."}]},"debugNamespace":{"type":"string","example":"braintrust","description":"Scopes a `kubectl` debug grant to one Kubernetes namespace. Requires `debugTool: kubectl`."},"debugCloudScope":{"type":"string","example":"123456789012/prod-readonly","description":"Scopes an `aws`/`gcloud`/`az` debug grant to a customer-meaningful account/project/subscription string. Requires `debugTool` set to that provider."}},"required":["deploymentId"]},"AccessRequestApprovalMethod":{"type":"string","example":"slack"},"AccessRequestActivity":{"type":"object","properties":{"operations":{"type":"array","items":{"type":"object","properties":{"commandId":{"type":"string"},"invocationId":{"type":"string","nullable":true,"description":"The MCP invocation that dispatched the command, when MCP did."},"command":{"type":"string","description":"`plugin/operation`."},"state":{"type":"string"},"createdAt":{"type":"string"},"dispatchedAt":{"type":"string","nullable":true},"completedAt":{"type":"string","nullable":true},"verification":{"$ref":"#/components/schemas/CommandVerification"}},"required":["commandId","invocationId","command","state","createdAt","dispatchedAt","completedAt","verification"]}},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"state":{"$ref":"#/components/schemas/DebugSessionState"},"owner":{"type":"string","nullable":true},"createdAt":{"type":"string"},"expiresAt":{"type":"string"}},"required":["id","state","owner","createdAt","expiresAt"]}}},"required":["operations","debugSessions"]},"RevokeAccessRequest":{"type":"object","properties":{"reason":{"type":"string","maxLength":4096,"description":"Why the grant is withdrawn, for the audit trail."}}},"SyncListResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"name":{"type":"string","minLength":2,"maxLength":100,"pattern":"^(?!ag[-_])[a-z0-9](-?[a-z0-9])*$","description":"Deployment name.","example":"acme-prod"},"publicSubdomain":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$","description":"Public subdomain for auto-generated domains"},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"projectId":{"type":"string","pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform for the deployment"},"basePlatform":{"type":"string","nullable":true,"enum":["aws","gcp","azure",null],"description":"Underlying cloud platform for Kubernetes deployments."},"region":{"type":"string","nullable":true,"description":"Cloud region or location for the deployment."},"deploymentProtocolVersion":{"$ref":"#/components/schemas/DeploymentProtocolVersion"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"ID of deployment group this deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"purpose":{"$ref":"#/components/schemas/DeploymentPurpose"},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}],"description":"Cloud environment information"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-provided configuration (network, deployment model, approvals)"},"stackState":{"type":"object","nullable":true,"properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"State of infrastructure components managed by this deployment"},"runtimeMetadata":{"type":"object","nullable":true,"properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment state persistence"},"currentReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the currently deployed release (actual state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"desiredReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the desired release for deployment/update (desired state)","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"pinnedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"ID of the pinned release","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"releaseChannel":{"allOf":[{"$ref":"#/components/schemas/ReleaseChannelName"},{"description":"Named release stream followed when the deployment is not pinned"}]},"importSource":{"type":"string","nullable":true,"enum":["cloudformation","terraform","helm",null],"description":"Setup source that imported this deployment"},"setupMethod":{"type":"string","nullable":true,"enum":["cloudformation","google-oauth","terraform","helm","cli","manual",null],"description":"Setup method that created the deployment record and owns setup-time resources."},"setupMetadata":{"type":"object","nullable":true,"additionalProperties":{"nullable":true},"description":"Setup method metadata needed to guide privileged teardown."},"setupTarget":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup target for compatibility checks"},"setupFingerprint":{"type":"string","nullable":true,"minLength":1,"description":"Imported setup compatibility fingerprint"},"setupFingerprintVersion":{"type":"integer","nullable":true,"minimum":0,"exclusiveMinimum":true,"description":"Imported setup fingerprint algorithm version"},"operatorScope":{"type":"string","nullable":true,"description":"Display-only scope reported by the Operator manifest"},"operatorPermission":{"type":"string","nullable":true,"description":"Display-only permission tier reported by the Operator manifest"},"operatorVersion":{"type":"string","nullable":true,"description":"Version reported by the Operator"},"capabilities":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Capability state reported by the Operator"},"observedOperationsBundleHash":{"type":"string","nullable":true,"description":"Enabled-plugin-bundle-set hash the Operator reports having loaded"},"observedOperations":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/ReportedOperation"},"description":"Operations the Operator reports as currently loaded"},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment"},"lastHeartbeatAt":{"type":"string","format":"date-time","nullable":true,"description":"Timestamp of the last received heartbeat from the deployment"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Latest error information if the deployment is in a failed state"},"updateState":{"type":"object","properties":{"active":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"next":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"},"latest":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["active","next","latest"],"description":"Durable progress for deployment updates"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"ID of the manager responsible for this deployment"}]},"workspaceId":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"userEnvironmentVariables":{"type":"array","nullable":true,"items":{"$ref":"#/components/schemas/EnvironmentVariableConfig"}},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."},"deploymentToken":{"type":"string","nullable":true},"lockedBy":{"type":"string","nullable":true},"lockedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","name","status","projectId","platform","deploymentProtocolVersion","deploymentGroupId","purpose","stackSettings","releaseChannel","retryRequested","createdAt","updatedAt","managerId","workspaceId","userEnvironmentVariables"]}}},"required":["deployments"],"description":"Full deployment records for manager operation"},"SyncListRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. Manager-scoped tokens are always constrained to their own manager ID."}]},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to include"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment status"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by deployment platform"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Filter by deployment group ID","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"limit":{"type":"integer","minimum":1,"maximum":500,"description":"Maximum records to return"}},"additionalProperties":false,"description":"Request to list full operational deployments"},"SyncAcquireResponseDeployment":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"deploymentGroupId":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Deployment group ID the deployment belongs to","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Setup method recorded on the deployment when it has a setup-owned path."}]},"operationId":{"type":"string","nullable":true,"pattern":"duop_[0-9a-z]{28}$","description":"Immutable target claimed for this execution, or null for observation-only work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","nullable":true,"pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed by this manager session, or null for observation-only work.","example":"duat_uve04tou5eoua3q17dar1pz"},"current":{"$ref":"#/components/schemas/DeploymentState"},"config":{"$ref":"#/components/schemas/DeploymentConfig"}},"required":["deploymentId","projectId","deploymentGroupId","operationId","attemptId","current","config"]},"DeploymentState":{"type":"object","properties":{"currentRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]},"environmentInfo":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string","description":"AWS account ID"},"region":{"type":"string","description":"AWS region"}},"required":["accountId","region"],"description":"AWS-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"projectId":{"type":"string","description":"GCP project ID (e.g., \"my-project\")"},"projectNumber":{"type":"string","description":"GCP project number (e.g., \"123456789012\")"},"region":{"type":"string","description":"GCP region"}},"required":["projectId","projectNumber","region"],"description":"GCP-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string","description":"Azure location/region"},"subscriptionId":{"type":"string","description":"Azure subscription ID"},"tenantId":{"type":"string","description":"Azure tenant ID"}},"required":["location","subscriptionId","tenantId"],"description":"Azure-specific environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"arch":{"type":"string","description":"Architecture (e.g., \"x86_64\", \"aarch64\")"},"hostname":{"type":"string","description":"Hostname of the machine running the deployment"},"os":{"type":"string","description":"Operating system (e.g., \"linux\", \"macos\", \"windows\")"}},"required":["arch","hostname","os"],"description":"Local platform environment information"},{"type":"object","properties":{"platform":{"type":"string","enum":["local"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"testId":{"type":"string","description":"Test identifier for this environment"}},"required":["testId"],"description":"Test platform environment information (mock)"},{"type":"object","properties":{"platform":{"type":"string","enum":["test"]}},"required":["platform"]}]},{"nullable":true}]},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"protocolVersion":{"type":"integer","minimum":0,"description":"Protocol version for cross-actor compatibility.\nAll actors (manager, push client, agent) check this before stepping.\nMismatched versions produce a clear error instead of silent corruption.\nSee docs/02-manager/10-deployment-protocol.md."},"retryRequested":{"type":"boolean","description":"Whether a retry has been requested for a failed deployment\nWhen true and status is a failed state, the deployment system will retry failed resources"},"runtimeMetadata":{"oneOf":[{"type":"object","properties":{"deployerSecrets":{"type":"array","items":{"type":"object","properties":{"inputId":{"type":"string","description":"Stack input id."},"label":{"type":"string","description":"The input's label."},"location":{"type":"object","properties":{"cliCommand":{"type":"string","description":"Command that writes the value, with `<VALUE>` in place of the secret."},"consoleUrl":{"type":"string","nullable":true,"description":"Cloud console page where the secret is created, when the store has one."},"name":{"type":"string","description":"Full name of the secret in that store."},"store":{"type":"string","enum":["aws-parameter-store","gcp-secret-manager","azure-key-vault","kubernetes-secret","local-vault"],"description":"The secret store a deployer writes a vault-native secret into."},"vaultName":{"type":"string","nullable":true,"description":"The Azure Key Vault that holds the secret. Other stores resolve `name`\nin the stack's own account or project."}},"required":["cliCommand","name","store"],"description":"Where a deployer writes a vault-native secret."},"message":{"type":"string","nullable":true,"description":"Why the slot is invalid."},"required":{"type":"boolean","description":"Whether the workload cannot start without it."},"status":{"type":"string","enum":["present","missing","invalid"],"description":"Whether a deployer secret slot holds a usable value. Alien learns this from\nmetadata only and never reads the value."}},"required":["inputId","label","location","required","status"],"description":"The state of one deployer secret slot, reported with the deployment."},"description":"Whether each vault-native deployer secret is in the customer's secret\nstore, with where it goes. Checked from metadata only; no value is ever\nread or recorded here."},"directSetupRevision":{"type":"string","nullable":true,"description":"Last generated CLI package revision whose direct setup was applied.\nThis lets a newer generated CLI refresh setup-owned infrastructure once\nbefore handing runtime changes back to the hosted manager."},"initialSetupAuthority":{"type":"string","enum":["importedHandoff","directSetup"],"description":"Actor that owns structural work during the initial setup phase."},"lastSyncedEnvVarsHash":{"type":"string","nullable":true,"description":"Hash of the environment variables snapshot that was last synced to the vault\nUsed to avoid redundant sync operations during incremental deployment"},"lastSyncedSecretNames":{"type":"array","items":{"type":"string"},"description":"Exact vault keys owned by the deployment secret synchronizer. This\ninventory lets a later snapshot delete removed keys without listing or\ntouching unrelated values in the same vault."},"pendingPreparedReleaseId":{"type":"string","nullable":true,"description":"Release `pending_prepared_stack` was prepared from. The target can move\nto a newer release while that stack is still being applied; this tells\nthe update which release actually converged."},"pendingPreparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"persistedGateAnswers":{"type":"object","properties":{},"additionalProperties":{"type":"boolean"},"description":"Canonical resolved answers for inputs that gate Frozen resources,\nkeyed by input id, recorded when the deployment is created or its\nsetup import registers.\n\nA frozen gate's answer is fixed for the deployment's lifetime: the\nupdate path refuses input values that conflict with these, and a Live\nresource sharing such an input resolves the persisted answer forever."},"preparedStack":{"oneOf":[{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},{"nullable":true}]},"registryAccess":{"oneOf":[{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string"},"description":"Repository identifiers the grant names, sorted."},"serviceTypes":{"type":"array","items":{"type":"string"},"description":"Compute services the grant admits, sorted. Each pulls as its own principal, so a service\nadded later needs the policy rewritten."}},"description":"The cross-account read a manager opened on Alien's registry for one deployment."},{"nullable":true}]},"registryAccessGranted":{"type":"boolean","description":"Whether cross-account registry access has been successfully granted.\nSet to true after the manager successfully sets the ECR/GAR repo policy\nfor this deployment's target account. Prevents redundant API calls on\nevery reconcile tick."},"setupScaffolding":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"buildRoleName":{"type":"string","description":"IAM role the image build runs as."},"egress":{"oneOf":[{"type":"object","properties":{"connectorArn":{"type":"string","nullable":true,"description":"`AWS::Lambda::NetworkConnector` the sessions start with."},"connectorRequest":{"type":"string","nullable":true,"description":"Cloud Control request creating or deleting the connector that AWS has not finished. Kept\nso the request's outcome, and AWS's reason when it fails, is read on a later call."},"operatorRoleName":{"type":"string","description":"IAM role Lambda assumes to place the connector's network interfaces."},"securityGroupId":{"type":"string","nullable":true,"description":"Security group permitting egress to loopback only."}},"required":["operatorRoleName"],"description":"The objects that keep an AWS deny sandbox's sessions inside the VPC. Each id is recorded as\nsoon as the object exists and cleared once it is deleted."},{"nullable":true}]},"imageArn":{"type":"string","nullable":true,"description":"A Frozen sandbox's MicroVM image, built during setup. A Live one's image belongs to its\nruntime controller."},"type":{"type":"string","enum":["awsSandbox"]}},"required":["buildRoleName","type"],"description":"Cloud objects a direct setup created so a runtime-owned resource can run."},"description":"What a direct setup created for resources it does not own, keyed by resource id. Setup\nteardown removes exactly what is recorded here."},"setupUpdateAuthorization":{"oneOf":[{"type":"object","properties":{"baselineFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the last successful deployment."},"nonce":{"type":"string","description":"Unique revision used by persistence layers for compare-and-swap updates."},"releaseId":{"type":"string","description":"Release whose stack was prepared by setup."},"setupFingerprint":{"type":"string","description":"Exact setup artifact revision that authored this authority."},"setupFingerprintVersion":{"type":"integer","minimum":0,"description":"Setup fingerprint contract version."},"setupTarget":{"type":"string","description":"Stable setup target recorded on the imported deployment."},"targetFrozenDigest":{"type":"string","description":"Setup-owned digest (`Stack::setup_owned_digest`) of the stack the setup re-import prepared."}},"required":["baselineFrozenDigest","nonce","releaseId","setupFingerprint","setupFingerprintVersion","setupTarget","targetFrozenDigest"],"description":"One-shot authority for a setup re-import to replace setup-owned resources."},{"nullable":true}]}},"description":"Runtime metadata for deployment\n\nStores deployment state that needs to persist across step calls."},{"nullable":true}]},"stackState":{"oneOf":[{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"resourcePrefix":{"type":"string","description":"A prefix used for resource naming to ensure uniqueness across deployments."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"_internal":{"nullable":true,"description":"The platform-specific resource controller that manages this resource's lifecycle.\nThis is None when the resource status is Pending.\nStored as JSON to make the struct serializable and movable to alien-core."},"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"controllerPlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Complete list of dependencies for this resource, including infrastructure dependencies.\nThis preserves the full dependency information from the stack definition."},"error":{"oneOf":[{"type":"object","properties":{"code":{"type":"string","maxLength":128,"description":"A unique identifier for the type of error.\n\nThis should be a short, machine-readable string that can be used\nby clients to programmatically handle different error types.\nExamples: \"NOT_FOUND\", \"VALIDATION_ERROR\", \"TIMEOUT\""},"context":{"nullable":true,"description":"Additional diagnostic information about the error context.\n\nThis optional field can contain structured data providing more details\nabout the error, such as validation errors, request parameters that\ncaused the issue, or other relevant context information."},"hint":{"type":"string","nullable":true,"description":"Optional human-facing remediation hint."},"httpStatusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599,"description":"HTTP status code for this error.\n\nUsed when converting the error to an HTTP response. If None, falls back to\nthe error type's default status code or 500."},"internal":{"type":"boolean","description":"Indicates if this is an internal error that should not be exposed to users.\n\nWhen `true`, this error contains sensitive information or implementation\ndetails that should not be shown to end-users. Such errors should be\nlogged for debugging but replaced with generic error messages in responses."},"message":{"type":"string","maxLength":16384,"description":"Human-readable error message.\n\nThis message should be clear and actionable for developers or end-users,\nproviding context about what went wrong and potentially how to fix it."},"retryable":{"type":"boolean","default":false,"description":"Indicates whether the operation that caused the error should be retried.\n\nWhen `true`, the error is transient and the operation might succeed\nif attempted again. When `false`, retrying the same operation is\nunlikely to succeed without changes."},"source":{"nullable":true,"description":"The underlying error that caused this error, creating an error chain.\n\nThis allows for proper error propagation and debugging by maintaining\nthe full context of how an error occurred through multiple layers\nof an application."}},"required":["code","internal","message"],"description":"Canonical error container that provides a structured way to represent errors\nwith rich metadata including error codes, human-readable messages, context,\nand chaining capabilities for error propagation.\n\nThis struct is designed to be both machine-readable and user-friendly,\nsupporting serialization for API responses and detailed error reporting\nin distributed systems."},{"nullable":true}]},"lastFailedState":{"nullable":true,"description":"Stores the controller state that failed, used for manual retry operations.\nThis allows resuming from the exact point where the failure occurred.\nStored as JSON to make the struct serializable and movable to alien-core."},"lifecycle":{"oneOf":[{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},{"nullable":true}]},"outputs":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["type"],"additionalProperties":{"nullable":true},"description":"Resource outputs that can hold output data for any resource type in the Alien system. All resource outputs share a common 'type' field with additional type-specific output properties."},{"nullable":true}]},"previousConfig":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},{"nullable":true}]},"remoteBindingParams":{"nullable":true,"description":"Binding parameters for remote access.\nOnly populated when the resource has `remote_access: true` in its ResourceEntry.\nThis is the JSON serialization of the binding configuration (e.g., StorageBinding, VaultBinding).\nPopulated by controllers during provisioning using get_binding_params()."},"retryAttempt":{"type":"integer","minimum":0,"description":"Tracks consecutive retry attempts for the current state transition."},"status":{"type":"string","enum":["pending","provisioning","provision-failed","running","updating","update-failed","deleting","delete-failed","teardown-required","deleted","refresh-failed"],"description":"Represents the high-level status of a resource during its lifecycle."},"type":{"type":"string","description":"The high-level type of the resource (e.g., Worker::RESOURCE_TYPE, Storage::RESOURCE_TYPE)."}},"required":["config","status","type"],"description":"Represents the state of a single resource within the stack for a specific platform."},"description":"The state of individual resources, keyed by resource ID."}},"required":["platform","resourcePrefix","resources"],"description":"Represents the collective state of all resources in a stack, including platform and pending actions."},{"nullable":true}]},"status":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"targetRelease":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."},{"nullable":true}]}},"required":["platform","protocolVersion","status"],"description":"Current deployment state (includes releases)"},"DeploymentConfig":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"volumeRestores":{"type":"array","items":{"type":"object","properties":{"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"Unique ID of this request. A controller performs each request once."},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute\nEngine snapshot name, or an Azure snapshot resource ID"}},"required":["ordinal","requestId","resourceId","snapshotId"],"description":"Replace one replica's persistent volume with a new volume made from a snapshot.\n\nThe controller stops the replica, snapshots the volume it is about to\nreplace (so the restore can be undone), creates the new volume in the same\nzone, starts the replica on it, and deletes the replaced volume."},"description":"Operator requests to replace a replica's persistent volume with a new\nvolume made from a snapshot. A container controller performs each\nrequest once, identified by its `request_id`, and reports it in\n`ContainerOutputs.volumes`."}},"required":["environmentVariables"],"description":"Deployment configuration"},"SyncContextRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the context. Manager-scoped tokens are constrained to their own manager ID."}]},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false},"SyncAcquireResponse":{"type":"object","properties":{"deployments":{"type":"array","items":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"},"description":"List of acquired deployments with deployment context"},"failures":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"ID of the deployment that failed","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"projectId":{"type":"string","description":"Project ID the deployment belongs to"},"error":{"allOf":[{"$ref":"#/components/schemas/APIError"},{"description":"Error that occurred during context building"}]}},"required":["deploymentId","projectId","error"]},"description":"List of deployments that failed during context building (locks already released)"},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time","description":"When the provisional leases on the returned deployments lapse. Confirm them with sync/renew before starting work. Null when nothing was acquired."}},"required":["deployments","failures","leaseExpiresAt"],"description":"Acquired deployments and failures"},"SyncAcquireRequest":{"type":"object","properties":{"managerId":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Manager requesting the deployments. If omitted, resolved from each deployment's managerId column."}]},"session":{"type":"string","description":"Unique session identifier for lock tracking"},"requestId":{"type":"string","minLength":1,"description":"Idempotency key for one logical acquire request"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"description":"Specific deployment IDs to lock (for Pull model sync)"},"statuses":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter by deployment statuses (default: all deployment statuses)"},"platforms":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter by platforms (default: all platforms the Manager supports)"},"setupMethod":{"allOf":[{"$ref":"#/components/schemas/DeploymentSetupMethod"},{"description":"Filter by setup method for setup-owned acquisition paths"}]},"acquireMode":{"type":"string","enum":["runtime","setup-run","setup-teardown"],"description":"Phase ownership mode for deployment acquisition"},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model from stackSettings.deploymentModel."},"supportsExecutionClaims":{"type":"boolean","enum":[true],"description":"Signals support for echoing executionClaim on renew, reconcile, and release."},"limit":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of deployments to acquire (default: 10)"}},"required":["session","requestId","deploymentModel"],"additionalProperties":false,"description":"Request to acquire deployments for processing"},"SyncReconcileResponse":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the state was reconciled"},"current":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Current deployment state after reconciliation"}]},"target":{"$ref":"#/components/schemas/TargetDeployment"},"targetOperationsBundleSet":{"$ref":"#/components/schemas/TargetOperationsBundleSet"},"targetDynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"image":{"type":"string","maxLength":512,"pattern":"^[^\\s@]+@sha256:[a-f0-9]{64}$"},"cpu":{"type":"string","pattern":"^(?:0\\.[1-9]\\d?|[1-7](?:\\.\\d{1,2})?|8(?:\\.0{1,2})?)$"},"memory":{"type":"string","pattern":"^(?:[1-9]\\d{0,3})Mi$"},"replicas":{"type":"integer","minimum":0,"maximum":20},"ports":{"type":"array","items":{"type":"integer","minimum":1,"maximum":65535},"maxItems":8},"deleted":{"type":"boolean"},"env":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"secretEnv":{"type":"object","additionalProperties":{"type":"string","maxLength":8192}},"healthCheck":{"type":"object","properties":{"path":{"type":"string","maxLength":256},"port":{"type":"integer","minimum":1,"maximum":65535}},"required":["path","port"]},"suspendedReason":{"type":"string","maxLength":512}},"required":["name","generation","image","cpu","memory","replicas","ports","deleted","env","secretEnv"]},"description":"Complete release-independent dynamic container target set for a Kubernetes Operator."}},"required":["success","current"],"description":"State reconciliation result with optional target"},"TargetDeployment":{"type":"object","properties":{"config":{"type":"object","properties":{"allowFrozenChanges":{"type":"boolean","description":"Allow frozen resource changes during updates\nWhen true, skips the frozen resources compatibility check.\nThis requires running with elevated cloud credentials."},"basePlatform":{"oneOf":[{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},{"nullable":true}]},"computeBackend":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusters":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"clusterId":{"type":"string","description":"Cluster ID (deterministic: workspace/project/deployment/resourceid)"},"managementToken":{"type":"string","description":"Management token for API access (hm_...)\nUsed by alien-deployment controllers to create/update containers"}},"required":["clusterId","managementToken"],"description":"Configuration for a single container worker cluster.\n\nContains the cluster ID and management token needed to interact with\nthe managed container control plane API for container operations."},"description":"Cluster configurations (one per ComputeCluster resource)\nKey: ComputeCluster resource ID from stack\nValue: Cluster ID and management token for that cluster"},"horizonMachineImage":{"oneOf":[{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"amis":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"AMI IDs by architecture, then AWS region."}},"required":["amis"],"description":"AWS Horizon machine image catalog."},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"imageVersionId":{"type":"string","description":"Azure Compute Gallery image version ID."}},"required":["imageVersionId"],"description":"Azure Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"Azure Horizon machine image catalog."},{"nullable":true}]},"baseImage":{"type":"object","properties":{"name":{"type":"string","description":"Base OS image name."},"version":{"type":"string","description":"Base OS image version or channel."}},"required":["name","version"],"description":"Base image metadata for the Horizon machine image."},"channel":{"type":"string","description":"Logical image channel, such as prod, staging, or canary."},"createdAt":{"type":"string","description":"Image manifest creation timestamp."},"gcp":{"oneOf":[{"type":"object","properties":{"images":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sourceImage":{"type":"string","description":"Source image self link or image-family URL."}},"required":["sourceImage"],"description":"GCP Horizon machine image entry."},"description":"Images by architecture."}},"required":["images"],"description":"GCP Horizon machine image catalog."},{"nullable":true}]},"gitSha":{"type":"string","description":"Git commit SHA used to build the image."},"horizondArtifacts":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"sha256":{"type":"string","description":"SHA-256 digest for the artifact payload."},"url":{"type":"string","description":"HTTPS URL for the artifact."}},"required":["sha256","url"],"description":"Download artifact for one horizond release platform."},"description":"Per-architecture horizond artifacts by release-platform key."},"horizondVersion":{"type":"string","description":"horizond daemon version baked into the image."},"machineImageVersion":{"type":"string","description":"Published immutable machine image version."}},"required":["baseImage","channel","createdAt","gitSha","horizondArtifacts","horizondVersion","machineImageVersion"],"description":"Horizon machine image catalog.\n\nPlatform resolves concrete provider images from this catalog during rollout."},{"nullable":true}]},"url":{"type":"string","description":"Horizon control-plane API base URL."}},"required":["clusters","url"],"description":"Horizon control-plane configuration for container orchestration.\n\nContains all the information needed for Alien to interact with managed\ncontainer clusters during deployment. Each ComputeCluster resource gets its own\nentry in the clusters map."},{"type":"object","properties":{"type":{"type":"string","enum":["horizon"]}},"required":["type"]}],"description":"Compute backend for Container and Worker resources.\n\nDetermines how compute workloads are orchestrated on cloud platforms.\nWhen None, the platform default is used for cloud platforms."},{"nullable":true}]},"deploymentName":{"type":"string","nullable":true,"description":"Human-readable deployment name for cloud console metadata.\n\nThis is separate from the physical resource prefix in StackState. It is\nused only for display text such as IAM role descriptions, service\naccount descriptions, and custom role titles."},"deploymentToken":{"type":"string","nullable":true,"description":"Deployment token for pull authentication with the manager's registry.\n\nUsed by controllers to configure registry credentials so cloud platforms\nand K8s can pull images from the manager's `/v2/` endpoint."},"domainMetadata":{"oneOf":[{"type":"object","properties":{"baseDomain":{"type":"string","description":"Base domain for auto-generated domains (e.g., \"vpc.direct\")."},"hostedZoneId":{"type":"string","description":"Hosted zone ID for DNS records."},"publicSubdomain":{"type":"string","description":"Deployment public subdomain (e.g., \"k8f2j3\")."},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"aliases":{"type":"array","items":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Additional managed hostnames for the resource."},"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"endpoints":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"certificateChain":{"type":"string","nullable":true,"description":"Full PEM certificate chain (only present if status is \"issued\")."},"certificateId":{"type":"string","description":"Certificate ID (for tracking/logging)."},"certificateStatus":{"type":"string","enum":["pending","issued","renewing","renewal-failed","failed","deleting"],"description":"Certificate status in the certificate lifecycle"},"dnsError":{"type":"string","nullable":true,"description":"Last DNS error message. Present when DNS previously failed, even if status\nwas reset to pending for retry. Used to surface actionable error context\nin WaitingForDns failure messages."},"dnsStatus":{"type":"string","enum":["pending","active","updating","deleting","failed"],"description":"DNS record status in the DNS lifecycle"},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a managed hostname.\n\nIncludes decrypted certificate data for issued certificates.\nPrivate keys are deployment-scoped secrets (like environment variables)."},"description":"Endpoint-scoped metadata keyed by endpoint name."},"fqdn":{"type":"string","description":"Fully qualified domain name."},"issuedAt":{"type":"string","nullable":true,"description":"ISO 8601 timestamp when certificate was issued (for renewal detection)."},"privateKey":{"type":"string","nullable":true,"description":"Decrypted private key (only present if status is \"issued\")."}},"required":["certificateId","certificateStatus","dnsStatus","fqdn"],"description":"Certificate and DNS metadata for a public resource.\n\nThe direct fields describe the primary endpoint hostname. `endpoints`\ncontains endpoint-scoped metadata keyed by endpoint name. `aliases` contains\nadditional managed hostnames that route directly to the primary endpoint."},"description":"Metadata per resource ID."}},"required":["baseDomain","hostedZoneId","publicSubdomain","resources"],"description":"Domain metadata for auto-managed public resources (no private keys)."},{"nullable":true}]},"environmentVariables":{"type":"object","properties":{"createdAt":{"type":"string","description":"ISO 8601 timestamp when snapshot was created"},"hash":{"type":"string","description":"Deterministic hash of all variables (for change detection)"},"variables":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Variable name"},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource patterns (null = all resources, Some = wildcard patterns)"},"type":{"type":"string","enum":["plain","secret"],"description":"Type of environment variable"},"value":{"type":"string","description":"Variable value (decrypted - deployment has access to decryption keys)"}},"required":["name","type","value"],"description":"Environment variable for deployment"},"description":"Environment variables in the snapshot"}},"required":["createdAt","hash","variables"],"description":"Snapshot of environment variables at a point in time"},"externalBindings":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"accessKeyId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"endpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"forcePathStyle":{"type":"boolean","nullable":true,"description":"Use path-style URLs (`endpoint/bucket/key`) instead of virtual-hosted\nones (`bucket.endpoint/key`). Defaults to `true` when `endpoint` is\nset, since most S3-compatible stores require it."},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"secretAccessKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"S3 storage binding configuration.\n\nTargets AWS S3 by default. Setting `endpoint` targets any S3-compatible\nstore instead (MinIO, Ceph RGW, NetApp StorageGRID, Cloudflare R2, ...),\nwhich is how Kubernetes deployments outside a cloud account attach the\ncustomer's existing object storage."},{"type":"object","properties":{"service":{"type":"string","enum":["s3"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"containerName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Blob Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["blob"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"bucketName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Cloud Storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gcs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"storagePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local filesystem storage binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-storage"]}},"required":["service"]}]}],"description":"Service-type based storage binding that supports multiple storage providers"},{"type":"object","properties":{"type":{"type":"string","enum":["storage"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"queueUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SQS queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["sqs"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"subscription":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"topic":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Pub/Sub parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["pubsub"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"queueName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Service Bus parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["servicebus"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"queuePath":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local queue parameters"},{"type":"object","properties":{"service":{"type":"string","enum":["local-queue"]}},"required":["service"]}]}],"description":"Binding parameters for Queue at runtime or in templates."},{"type":"object","properties":{"type":{"type":"string","enum":["queue"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"endpointUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"region":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS DynamoDB KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["dynamodb"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"collectionName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"databaseId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"projectId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Firestore KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["firestore"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"tableName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Table Storage KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["tablestorage"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"connectionUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Redis KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["redis"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"keyPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Local development KV binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["local-kv"]}},"required":["service"]}]}],"description":"Represents a KV binding for key-value storage across platforms"},{"type":"object","properties":{"type":{"type":"string","enum":["kv"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushRoleArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS ECR (Elastic Container Registry) binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["ecr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"registryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"repositoryPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Container Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["acr"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"pullServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"pushServiceAccountEmail":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]},"repositoryName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Google Artifact Registry binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["gar"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"type":"string"},{"nullable":true},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"registryUrl":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Local container registry binding configuration.\n\nThe local registry runs on localhost only and does not require authentication.\nSecurity boundary is the OS process isolation on the customer's machine.\nExternal image access is secured by the manager's registry proxy (deployment tokens)."},{"type":"object","properties":{"service":{"type":"string","enum":["local"]}},"required":["service"]}]}],"description":"Service-type based artifact registry binding that supports multiple registry providers"},{"type":"object","properties":{"type":{"type":"string","enum":["artifact_registry"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS SSM Parameter Store vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["parameter-store"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Secret Manager vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["secret-manager"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"vaultName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Key Vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["key-vault"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultPrefix":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Kubernetes Secrets vault binding configuration"},{"type":"object","properties":{"service":{"type":"string","enum":["kubernetes-secret"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"dataDir":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"vaultName":{"type":"string","description":"The vault name for local storage"}},"required":["vaultName"],"description":"Local development vault binding (for testing/development)"},{"type":"object","properties":{"service":{"type":"string","enum":["local-vault"]}},"required":["service"]}]}],"description":"Represents a vault binding for secure secret management"},{"type":"object","properties":{"type":{"type":"string","enum":["vault"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"defaultDomain":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"environmentName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceGroupName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"resourceId":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"staticIp":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]},{"nullable":true}]}},"description":"Binding configuration for a pre-existing Azure Container Apps Environment.\n\nUsed when deploying to an existing environment instead of having Alien provision one.\nThis is useful for shared environments (e.g., test infrastructure) or enterprise\nsetups where environments are managed by a separate team."},{"type":"object","properties":{"type":{"type":"string","enum":["container_apps_environment"]}},"required":["type"]}]},{"allOf":[{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterEndpoint":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretArn":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"AWS Aurora Serverless v2 binding."},{"type":"object","properties":{"service":{"type":"string","enum":["aurora"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretName":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"serverCaCertificates":{"oneOf":[{"type":"array","items":{"type":"string"}},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"GCP Cloud SQL binding."},{"type":"object","properties":{"service":{"type":"string","enum":["cloud-sql"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"passwordSecretUri":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"description":"Azure Flexible Server binding."},{"type":"object","properties":{"service":{"type":"string","enum":["flexible-server"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string","description":"Connection password as a concrete value, never an unresolved `SecretRef`: the platform\nmaterializes the Kubernetes secret into the pod env. The cloud variants carry a secret\nlocator instead."},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"sslMode":{"type":"string","enum":["verify-full","disable"],"description":"TLS policy for an operator-provided / BYO Postgres database.\n\nUnlike libpq's ambiguous `prefer` mode, both choices map exactly to the\nconnection settings exposed by every supported SDK."},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Operator-provided / BYO database binding."},{"type":"object","properties":{"service":{"type":"string","enum":["external"]}},"required":["service"]}]},{"allOf":[{"type":"object","properties":{"database":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"host":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"password":{"type":"string"},"port":{"oneOf":[{"type":"integer"},{"nullable":true},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"username":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"}},"required":["password"],"description":"Local embedded Postgres binding."},{"type":"object","properties":{"service":{"type":"string","enum":["local-postgres"]}},"required":["service"]}]}],"description":"Connection details for a Postgres database, one variant per backend."},{"type":"object","properties":{"type":{"type":"string","enum":["postgres"]}},"required":["type"]}]},{"allOf":[{"type":"object","properties":{"apiKey":{"oneOf":[{"nullable":true},{"type":"string"},{"type":"object","properties":{"secretRef":{"type":"object","properties":{"key":{"type":"string"},"name":{"type":"string"}},"required":["key","name"],"description":"Reference to a Kubernetes Secret"}},"required":["secretRef"]}],"description":"Represents a value that can be either a concrete value, a template expression,\nor a reference to a Kubernetes Secret"},"provider":{"type":"string","description":"The external AI provider name (e.g., \"openai\", \"anthropic\")"}},"required":["provider"],"description":"External AI provider binding configuration (BYO-key).\n\nThe operator-supplied secret rides inside the binding via\n`BindingValue<String>`, so it is a literal on cloud platforms and gains\nKubernetes SecretRef resolution for free (`extract_binding_secrets` walks\nthe binding JSON for `secretRef`)."},{"type":"object","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]}]}],"description":"Represents a binding to pre-existing infrastructure.\n\nThe binding type must match the resource type it's applied to.\nValidated at runtime by the executor."},"description":"Map from resource ID to external binding.\n\nValidated at runtime: binding type must match resource type."},"inputValues":{"type":"object","properties":{},"additionalProperties":{"nullable":true},"description":"Deployer-provided stack input values, keyed by input id. A resource\ngated with `.enabled(input)` and a Live lifecycle follows these\nvalues; a missing key falls back to the input's declared boolean\ndefault. Suppliers must not place secret-kind input values here:\nthis map serializes and debug-prints unredacted."},"labelDomain":{"type":"string","nullable":true,"description":"DNS-style label domain used for Kubernetes resource ownership labels.\n\nDefaults to `alien.dev` when absent. Whitelabeled Operator builds set this\nso generated workloads and optional log collectors share the same label\nnamespace."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]},{"nullable":true}]},"managerUrl":{"type":"string","nullable":true,"description":"Manager base URL (e.g., \"https://manager.alien.dev\").\n\nThe manager IS the container registry — its `/v2/` endpoint serves as\nthe OCI Distribution API. Controllers derive the proxy host from this\nto configure pull auth (RegistryCredentials, imagePullSecrets).\n\nWhen None (e.g., `alien dev`), controllers use image URIs as-is."},"monitoring":{"oneOf":[{"type":"object","properties":{"logsAuthHeader":{"type":"string","description":"Auth header value in \"key=value,...\" format.\nExample: \"authorization=Bearer <write-token>\""},"logsEndpoint":{"type":"string","description":"Full OTLP logs endpoint URL.\nExample: \"https://<manager-host>/v1/logs\""},"metricsAuthHeader":{"type":"string","nullable":true,"description":"Auth header value for the metrics endpoint in \"key=value,...\" format (optional).\n\nWhen absent, `logs_auth_header` is reused for metrics -- suitable when the same\ncredential covers both signals. When present (e.g. Axiom with separate datasets),\nthis value is used exclusively for metrics.\n\nExample: \"authorization=Bearer <token>,x-axiom-dataset=<metrics-dataset>\""},"metricsEndpoint":{"type":"string","nullable":true,"description":"Full OTLP metrics endpoint URL (optional).\nWhen set, the worker runtime exports its own VM/container orchestration metrics here.\nExample: \"https://api.axiom.co/v1/metrics\""},"resourceAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Resource attributes attached to every OTLP signal emitted for this deployment.\n\nPlatform managers use this for stable identity such as `alien.workspace_id`,\n`alien.project_id`, `alien.deployment_group_id`, and `alien.deployment_id`.\nRuntime-specific resource attributes such as `service.name` remain owned by\nthe runtime/exporter."}},"required":["logsAuthHeader","logsEndpoint"],"description":"OTLP log export configuration for a deployment.\n\nWhen set, injected compute runtimes export captured application logs\nthrough the given endpoint via OTLP/HTTP; which resources are injected\nis platform-dependent. Workers read auth headers from a runtime-only\nsecret. Runtime-less Containers and Daemons receive standard OTEL auth\nvariables only at the final hosting boundary: Local passes them directly\nto the process and Kubernetes projects them from a per-workload Secret."},{"nullable":true}]},"nativeImageHost":{"type":"string","nullable":true,"description":"Native image registry host+prefix for platforms that require it.\n\nLambda (ECR) and Cloud Run (GAR) require native registry URIs. Other\nruntimes, including Azure Container Apps, pull through the manager's\nregistry proxy.\n\nDerived by the manager from the artifact registry binding:\n- ECR: `{account_id}.dkr.ecr.{region}.amazonaws.com/{repository_prefix}`\n- GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`"},"observeAllNamespaces":{"type":"boolean","description":"When true the observe pass reports raw resources across every namespace\n(cluster scope); otherwise it stays within the operator's own namespace.\nThe label selector, if any, still filters within whichever scope applies.\nIgnored by cloud observers."},"observeLabelSelector":{"type":"string","nullable":true,"description":"Kubernetes label selector that narrows which raw resources the observe\npass reports (e.g. `app.kubernetes.io/part-of=my-app`). `None` observes\neverything in the namespace. Ignored by cloud observers."},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Public endpoint URLs for exposed resources (optional override).\n\nUse this only when a caller already knows the public URL. Managed public\nendpoint flows should prefer `domain_metadata` plus controller-reported\nload balancer outputs so DNS, certificate renewal, and route readiness\nstay tied to the resource state.\n\nIf not set, platforms determine public endpoint URLs from other sources:\n- Managed DNS/TLS flows: `domain_metadata` FQDN or load balancer DNS\n- Local: `http://localhost:{allocated_port}`\n- Custom or disabled exposure: no public endpoint URL unless a controller reports one\n\nOuter key: resource ID. Inner key: endpoint name. Value: public URL."},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}]},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}]}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."},"volumeRestores":{"type":"array","items":{"type":"object","properties":{"ordinal":{"type":"integer","minimum":0,"description":"Replica ordinal whose volume is replaced"},"requestId":{"type":"string","description":"Unique ID of this request. A controller performs each request once."},"resourceId":{"type":"string","description":"ID of the container resource that owns the volume"},"snapshotId":{"type":"string","description":"Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute\nEngine snapshot name, or an Azure snapshot resource ID"}},"required":["ordinal","requestId","resourceId","snapshotId"],"description":"Replace one replica's persistent volume with a new volume made from a snapshot.\n\nThe controller stops the replica, snapshots the volume it is about to\nreplace (so the restore can be undone), creates the new volume in the same\nzone, starts the replica on it, and deletes the replaced volume."},"description":"Operator requests to replace a replica's persistent volume with a new\nvolume made from a snapshot. A container controller performs each\nrequest once, identified by its `request_id`, and reports it in\n`ContainerOutputs.volumes`."}},"required":["environmentVariables"],"description":"Deployment configuration\n\nConfiguration for how to perform the deployment.\nNote: Credentials (ClientConfig) are passed separately to step() function."},"releaseInfo":{"type":"object","properties":{"description":{"type":"string","nullable":true,"description":"Short description of the release"},"releaseId":{"type":"string","nullable":true,"description":"Release ID (e.g., rel_xyz). `None` for an observe deployment, which has no\nAlien-assigned release — the platform resolves a release from `version`."},"stack":{"type":"object","properties":{"dynamicContainerImageResources":{"type":"array","items":{"type":"string"},"description":"Released Container resources whose image repositories are approved for\ncontainers created after installation."},"dynamicContainerRepositories":{"type":"array","items":{"type":"string"},"description":"Exact image repositories approved for containers created after installation.\nThe runtime API also requires an immutable SHA-256 digest."},"id":{"type":"string","description":"Unique identifier for the stack"},"inputs":{"type":"array","items":{"type":"object","properties":{"default":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["string"]},"value":{"type":"string","description":"String default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["number"]},"value":{"type":"string","description":"Number default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["boolean"]},"value":{"type":"boolean","description":"Boolean default."}},"required":["type","value"]},{"type":"object","properties":{"type":{"type":"string","enum":["stringList"]},"value":{"type":"array","items":{"type":"string"},"description":"String list default."}},"required":["type","value"]},{"nullable":true}]},"description":{"type":"string","description":"Human-facing helper text."},"env":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Environment variable name."},"targetResources":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Target resource IDs or patterns. None means every env-capable resource."},"type":{"oneOf":[{"type":"string","enum":["plain","secret"],"description":"Environment variable handling for a stack input mapping."},{"nullable":true}]}},"required":["name"],"description":"How a resolved stack input is injected into runtime environment variables."},"description":"Runtime env-var mappings for v1 input resolution."},"generate":{"oneOf":[{"type":"object","properties":{"length":{"type":"integer","minimum":0,"description":"Number of characters to generate."}},"required":["length"],"description":"Asks Alien to generate a secret input's value.\n\nThe value is an alphanumeric string (`A-Z`, `a-z`, `0-9`), so it is safe in\nconnection strings, command lines and environment variables. It is generated\nonce, when the deployment's input values are first resolved, and then kept\nwith the deployment's other input values."},{"nullable":true}]},"id":{"type":"string","description":"Stable input ID used by CLI/API calls."},"kind":{"type":"string","enum":["string","secret","number","integer","boolean","enum","stringList"],"description":"Primitive stack input kind."},"label":{"type":"string","description":"Human-facing field label."},"placeholder":{"type":"string","nullable":true,"description":"Example placeholder shown in UI."},"platforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Platforms where this input applies."},"providedBy":{"type":"array","items":{"type":"string","enum":["developer","deployer"],"description":"Who can provide a stack input value."},"description":"Who can provide this value."},"required":{"type":"boolean","description":"Whether a resolved value is required before deployment can proceed."},"validation":{"oneOf":[{"type":"object","properties":{"format":{"type":"string","nullable":true,"description":"Semantic format hint such as url."},"max":{"type":"string","nullable":true,"description":"Maximum number."},"maxItems":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string-list items."},"maxLength":{"type":"integer","nullable":true,"minimum":0,"description":"Maximum string length."},"min":{"type":"string","nullable":true,"description":"Minimum number."},"minItems":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string-list items."},"minLength":{"type":"integer","nullable":true,"minimum":0,"description":"Minimum string length."},"pattern":{"type":"string","nullable":true,"description":"Portable whole-value regex pattern."},"values":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Allowed string enum values."}},"description":"Portable stack input validation constraints."},{"nullable":true}]}},"required":["description","id","kind","label","providedBy","required"],"description":"Stack input definition serialized into a release stack."},"description":"Input definitions required before setup or deployment can proceed."},"permissions":{"type":"object","properties":{"management":{"oneOf":[{"type":"object","properties":{"extend":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["extend"]},{"type":"object","properties":{"override":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"}},"required":["override"]},{"type":"string","enum":["auto"]}],"description":"Management permissions configuration for stack management access"},"profiles":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"description":{"type":"string","description":"Human-readable description of what this permission set allows"},"id":{"type":"string","description":"Unique identifier for the permission set (e.g., \"storage/data-read\")"},"platforms":{"type":"object","properties":{"aws":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Optional condition for additional filtering (rare)"},"notResources":{"type":"array","items":{"type":"string"},"description":"ARN patterns rendered as IAM `NotResource`, in place of `resources`. Its one use is a\ntag-on-create grant whose implied check AWS authorizes against no resource; the build\nrefuses it anywhere else."},"resources":{"type":"array","items":{"type":"string"},"description":"Resource ARNs to bind to"}},"required":["resources"],"description":"AWS-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"effect":{"type":"string","enum":["Allow","Deny"],"description":"IAM effect. Defaults to Allow."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"AWS-specific platform permission configuration"},"description":"AWS permission configurations"},"azure":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"},"stack":{"type":"object","properties":{"scope":{"type":"string","description":"Scope (subscription/resource group/resource level)"}},"required":["scope"],"description":"Azure-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"Azure-specific platform permission configuration"},"description":"Azure permission configurations"},"gcp":{"type":"array","nullable":true,"items":{"type":"object","properties":{"binding":{"type":"object","properties":{"resource":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"},"stack":{"type":"object","properties":{"condition":{"oneOf":[{"type":"object","properties":{"expression":{"type":"string"},"title":{"type":"string"}},"required":["expression","title"],"description":"GCP IAM condition"},{"nullable":true}]},"scope":{"type":"string","description":"Scope (project/resource level)"}},"required":["scope"],"description":"GCP-specific binding specification"}},"description":"Generic binding configuration for permissions"},"description":{"type":"string","nullable":true,"description":"Short admin-facing description of why this entry exists."},"grant":{"type":"object","properties":{"actions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"AWS IAM actions (only for AWS)"},"dataActions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Azure actions (only for Azure)"},"permissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP permissions that require an exact residual custom role."},"predefinedRoles":{"type":"array","nullable":true,"items":{"type":"string"},"description":"Provider predefined roles to bind directly."},"residualPermissions":{"type":"array","nullable":true,"items":{"type":"string"},"description":"GCP residual custom permissions to pair with predefined roles."}},"description":"Grant permissions for a specific cloud platform"},"label":{"type":"string","nullable":true,"description":"Stable admin-facing label for this permission entry."}},"required":["binding","grant"],"description":"GCP-specific platform permission configuration"},"description":"GCP permission configurations"}},"description":"Platform-specific permission configurations"}},"required":["description","id","platforms"],"description":"A permission set that can be applied across different cloud platforms"},{"type":"string"}],"description":"Reference to a permission set - either by name or inline definition"}},"description":"Permission profile that maps resources to permission sets\nKey can be \"*\" for all resources or resource name for specific resource"},"description":"Permission profiles that define access control for compute services\nKey is the profile name, value is the permission configuration"}},"required":["profiles"],"description":"Combined permissions configuration that contains both profiles and management"},"resources":{"type":"object","properties":{},"additionalProperties":{"type":"object","properties":{"config":{"type":"object","properties":{"id":{"type":"string","description":"The unique identifier for this specific resource instance. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]). Maximum 64 characters."},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"additionalProperties":{"nullable":true},"description":"Resource that can hold any resource type in the Alien system. All resources share common 'type' and 'id' fields with additional type-specific properties."},"dependencies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["id","type"],"description":"Reference to a resource by its stable id and resource type."},"description":"Additional dependencies for this resource beyond those defined in the resource itself.\nThe total dependencies are: resource.get_dependencies() + this list"},"enabledWhen":{"type":"string","nullable":true,"description":"Id of the boolean stack input that decides whether this resource is\ncreated at all. `None` means always create it.\n\nSet by `.enabled(input)` in the SDK. Setup emitters render the resource\nconditionally on the matching template variable, so a deployer who says no\nnever gets the resource, its outputs, or anything derived from it."},"lifecycle":{"type":"string","enum":["frozen","live"],"description":"Describes the lifecycle of a resource within a stack, determining how it's managed and deployed."},"remoteAccess":{"type":"boolean","description":"Enable remote bindings for this resource (BYOB use case).\nWhen true, binding params are synced to StackState's `remote_binding_params`.\nDefault: false (prevents sensitive data in synced state)."}},"required":["config","dependencies","lifecycle"]},"description":"Map of resource IDs to their configurations and lifecycle settings"},"supportedPlatforms":{"type":"array","nullable":true,"items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Which platforms this stack supports. When None, all platforms are supported."}},"required":["id","resources"],"description":"A bag of resources, unaware of any cloud."},"version":{"type":"string","nullable":true,"description":"Version string (e.g., 2.1.0)"}},"required":["stack"],"description":"Release metadata\n\nIdentifies a specific release version and includes the stack definition.\nThe deployment engine uses this to track which release is currently deployed\nand which is the target."}},"required":["config","releaseInfo"],"description":"Target deployment if update is needed"},"TargetOperationsBundleSet":{"type":"object","properties":{"hash":{"type":"string","minLength":1,"maxLength":256},"bundles":{"type":"array","items":{"$ref":"#/components/schemas/OperationsBundleDownload"}}},"required":["hash","bundles"],"description":"Target operations-bundle set the Operator should converge its loaded plugin registry toward."},"OperationsBundleDownload":{"type":"object","properties":{"plugin":{"type":"string","minLength":1,"maxLength":128},"pluginVersion":{"type":"string","minLength":1,"maxLength":64},"url":{"type":"string","format":"uri","description":"Presigned URL to GET the bundle ZIP from. Short-lived."}},"required":["plugin","pluginVersion","url"]},"SyncReconcileRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to reconcile state for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Lock session (push model only) - verifies lock ownership"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Immutable operation claimed at acquisition. Required with attemptId for update execution.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Execution attempt claimed at acquisition. Required with operationId for update execution.","example":"duat_uve04tou5eoua3q17dar1pz"},"state":{"allOf":[{"$ref":"#/components/schemas/DeploymentState"},{"description":"Complete deployment state after step() execution"}]},"updateHeartbeat":{"type":"boolean","description":"Update heartbeat timestamp (for successful health checks)"},"suggestedDelayMs":{"type":"integer","minimum":0,"description":"Delay before this deployment should be acquired again."},"resourceHeartbeats":{"type":"array","items":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"description":"Latest typed resource heartbeats collected during this step."},"observedInventoryBatches":{"type":"array","items":{"$ref":"#/components/schemas/ObservedInventoryBatch"},"description":"Observed raw-resource inventory batches read during this step."},"capabilities":{"type":"array","items":{"$ref":"#/components/schemas/OperatorCapabilityReport"},"description":"Operator-reported runtime capabilities."},"operatorVersion":{"type":"string","minLength":1,"maxLength":128,"description":"Operator binary version reported by the runtime."},"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorImageIdentity"},"operationsReport":{"$ref":"#/components/schemas/OperationsReport"},"dynamicContainers":{"type":"array","items":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"generation":{"type":"integer","minimum":0,"exclusiveMinimum":true},"status":{"type":"string","enum":["pending","running","failing","stopped"]},"message":{"type":"string","maxLength":2048}},"required":["name","generation","status"]},"description":"Observed dynamic container generations from a Kubernetes Operator."}},"required":["deploymentId","state"],"additionalProperties":false,"description":"Request to reconcile deployment state"},"ObservedInventoryBatch":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"],"description":"Backend whose observer produced this snapshot."},"complete":{"type":"boolean","description":"Whether this batch is a complete replacement for the scope. Complete\nbatches tombstone previously observed rows in the same scope when they\nare absent from `resources`."},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"inventoryScope":{"type":"string","description":"Stable scope for the provider list operation that produced this batch."},"observedAt":{"type":"string","format":"date-time","description":"Time the inventory scope was observed."},"resources":{"type":"array","items":{"type":"object","properties":{"alienResourceId":{"type":"string","nullable":true},"attributes":{"type":"object","properties":{},"additionalProperties":{"nullable":true}},"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"counts":{"oneOf":[{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},{"nullable":true}]},"deploymentId":{"type":"string","nullable":true},"displayName":{"type":"string"},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"images":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."},"description":"Distinct container images the resource's running instances report, when\nthe provider exposes them."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerKind":{"type":"string","description":"Provider-native kind, such as `apps/v1/Deployment`,\n`AWS::S3::Bucket`, `storage.googleapis.com/Bucket`, or an Azure\nresource type."},"providerStale":{"type":"boolean"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"rawIdentity":{"type":"string","description":"Provider-native stable identity: Kubernetes object identity, cloud ARN,\nGCP full resource name, Azure resource id, etc."},"region":{"type":"string","nullable":true},"resourceTypeHint":{"oneOf":[{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."},{"nullable":true}]},"scope":{"type":"string","nullable":true},"version":{"type":"string","nullable":true,"description":"Release/version identity observed from the provider resource, when available."}},"required":["displayName","health","lifecycle","partial","providerKind","providerStale","rawIdentity"]}},"sourceKind":{"type":"string","description":"Writer/source for this inventory pass, such as `operator` or\n`manager-observer`."}},"required":["backend","complete","controllerPlatform","inventoryScope","observedAt","resources","sourceKind"]},"RemoteOperatorImageIdentity":{"type":"object","properties":{"source":{"type":"string","enum":["package","configured"]},"packageId":{"type":"string","nullable":true,"minLength":1},"packageVersion":{"type":"string","nullable":true,"minLength":1},"image":{"type":"string","pattern":"^[^\\s@]+@sha256:[0-9a-f]{64}$"},"digest":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"}},"required":["source","packageId","packageVersion","image","digest"],"additionalProperties":false,"description":"Immutable installer receipt self-reported by a running Remote Operator. This is not independent runtime image inspection."},"OperationsReport":{"type":"object","properties":{"loadedBundleHash":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"operations":{"type":"array","items":{"$ref":"#/components/schemas/ReportedOperation"},"default":[]}},"description":"Operations bundle set the Operator currently has loaded, for plugin-sync status tracking."},"SyncRenewRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Single deployment to renew. Deprecated: use deploymentIds. Retained so a manager built against the previous API keeps renewing during rollout.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"deploymentIds":{"type":"array","items":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"minItems":1,"maxItems":100,"description":"Deployments to renew or confirm. Renewal is per deployment: the response reports each one independently."},"claims":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Unique identifier for the deployment update attempt.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","operationId","attemptId"]},"maxItems":100,"description":"Claim identities for deployments currently executing an update."},"session":{"type":"string","minLength":1}},"required":["session"],"additionalProperties":false},"SyncReleaseRequest":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment ID to release","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"session":{"type":"string","description":"Session identifier to release"},"mode":{"type":"string","enum":["release","acknowledge-completed"],"description":"Defaults to release. acknowledge-completed discards an exact terminal pull receipt after a lost response; it never releases newer work or grants a live lease."},"operationId":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Operation returned by acquire. Required when the lease carried update work.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"attemptId":{"type":"string","pattern":"duat_[0-9a-z]{28}$","description":"Attempt returned by acquire. Required when the lease carried update work.","example":"duat_uve04tou5eoua3q17dar1pz"}},"required":["deploymentId","session"],"additionalProperties":false,"description":"Request to release deployment lock"},"ResolveResponse":{"type":"object","properties":{"managerId":{"type":"string","description":"Manager ID"},"managerName":{"type":"string","description":"Manager display name"},"managerUrl":{"type":"string","format":"uri","description":"Manager URL"},"managerIsSystem":{"type":"boolean","description":"Whether the manager is Alien-hosted"},"managerCloud":{"type":"string","nullable":true,"enum":["aws","gcp","azure","kubernetes","machines","local","test",null],"description":"Cloud where the private manager is hosted. Null for Alien-hosted managers."},"projectId":{"type":"string","description":"Resolved project ID"},"installContext":{"type":"object","properties":{"platform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"managementConfig":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}},"required":["platform","managementConfig"],"description":"Target install context derived from platform-managed manager metadata. Present for cloud push platforms."}},"required":["managerId","managerName","managerUrl","managerIsSystem","projectId"]},"CloudRegionsResponse":{"type":"object","properties":{"supportedRegions":{"$ref":"#/components/schemas/SupportedCloudRegions"}},"required":["supportedRegions"]},"BillingAuditLogRow":{"type":"object","properties":{"id":{"type":"string"},"workspaceId":{"type":"string","nullable":true},"action":{"type":"string"},"payload":{"nullable":true},"createdAt":{"type":"string"}},"required":["id","workspaceId","action","createdAt"]},"WorkspaceBillingEntitlements":{"type":"object","properties":{"planId":{"$ref":"#/components/schemas/PlanId"},"planStatus":{"$ref":"#/components/schemas/BillingPlanStatus"},"features":{"$ref":"#/components/schemas/BillingFeatureFlags"},"limits":{"$ref":"#/components/schemas/BillingLimits"},"syncedAt":{"type":"string","nullable":true,"format":"date-time"},"stale":{"type":"boolean"}},"required":["planId","planStatus","features","limits","syncedAt","stale"]},"PlanId":{"type":"string","enum":["starter","pro","pro_annual","enterprise"]},"BillingPlanStatus":{"type":"string","enum":["active","trialing","past_due","canceled","none"]},"BillingFeatureFlags":{"type":"object","properties":{"custom_domains":{"type":"boolean"},"private_managers":{"type":"boolean"},"operations_custom_plugins":{"type":"boolean"},"sso_saml":{"type":"boolean"},"audit_logs":{"type":"boolean"},"airgapped":{"type":"boolean"}},"required":["custom_domains","private_managers","operations_custom_plugins","sso_saml","audit_logs","airgapped"]},"BillingLimits":{"type":"object","properties":{"maxDeployments":{"type":"number","nullable":true},"maxProjects":{"type":"number","nullable":true},"maxSeats":{"type":"number","nullable":true},"maxCustomDomains":{"type":"number","nullable":true},"creditUsd":{"type":"number","nullable":true},"seatsIncluded":{"type":"number","nullable":true}},"required":["maxDeployments","maxProjects","maxSeats","maxCustomDomains","creditUsd","seatsIncluded"]},"WorkspaceGatewayOverview":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"summary":{"type":"object","properties":{"totalProjects":{"type":"integer","minimum":0},"gatewayProjects":{"type":"integer","minimum":0},"activeProjects":{"type":"integer","minimum":0},"setupInProgressProjects":{"type":"integer","minimum":0},"needsAttentionProjects":{"type":"integer","minimum":0},"connectedCustomers":{"type":"integer","minimum":0}},"required":["totalProjects","gatewayProjects","activeProjects","setupInProgressProjects","needsAttentionProjects","connectedCustomers"]},"projects":{"type":"array","items":{"$ref":"#/components/schemas/GatewayProjectOverview"}}},"required":["generatedAt","summary","projects"]},"GatewayProjectOverview":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"state":{"$ref":"#/components/schemas/GatewayProjectState"},"connectedCustomers":{"type":"integer","minimum":0},"settingUpCustomers":{"type":"integer","minimum":0},"needsAttentionCustomers":{"type":"integer","minimum":0},"revokedCustomers":{"type":"integer","minimum":0}},"required":["id","name","state","connectedCustomers","settingUpCustomers","needsAttentionCustomers","revokedCustomers"]},"GatewayProjectState":{"type":"string","enum":["not-set-up","setup-in-progress","active","needs-attention"]},"GatewayKind":{"type":"string","enum":["ai","encryption","sandbox"],"description":"Alien Gateway a customer deployment runs","example":"ai"}},"parameters":{}},"paths":{"/v1/invitations/{token}":{"get":{"operationId":"getWorkspaceInvitationPreview","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation preview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitationPreview"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/memberships":{"get":{"operationId":"listMemberships","description":"List all workspaces the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listMemberships","responses":{"200":{"description":"List of user's workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Membership"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile":{"get":{"operationId":"getUserProfile","description":"Get the current user's profile and user-scoped onboarding state.","x-speakeasy-group":"user","x-speakeasy-name-override":"getProfile","responses":{"200":{"description":"User profile.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateUserProfile","description":"Update the current user's profile (display name).","x-speakeasy-group":"user","x-speakeasy-name-override":"updateProfile","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":100,"description":"Display name"}}}}}},"responses":{"200":{"description":"Profile updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/profile/setup":{"post":{"operationId":"completeUserProfileSetup","description":"Complete the required beta intake and profile setup dialog.","x-speakeasy-group":"user","x-speakeasy-name-override":"completeProfileSetup","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfileSetupRequest"}}}},"responses":{"200":{"description":"Profile setup completed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UserProfile"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/workspaces":{"post":{"operationId":"createWorkspace","description":"Create a new workspace. The current user will be automatically added as an admin.","x-speakeasy-group":"user","x-speakeasy-name-override":"createWorkspace","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name"},"logoUrl":{"type":"string","format":"uri","description":"Optional workspace logo URL"}},"required":["name"]}}}},"responses":{"201":{"description":"Created workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Membership"}}}},"400":{"description":"Bad request - invalid workspace name.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Workspace name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces":{"get":{"operationId":"listGitNamespaces","description":"List all git namespaces (GitHub installations) the current user has access to.","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaces","parameters":[{"schema":{"type":"string","enum":["github"],"default":"github"},"required":false,"name":"provider","in":"query"}],"responses":{"200":{"description":"List of user's git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/sync":{"post":{"operationId":"syncGitNamespaces","description":"Sync git namespaces from the provider. For GitHub, this fetches all app installations accessible to the user.","x-speakeasy-group":"user","x-speakeasy-name-override":"syncGitNamespaces","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["github"],"description":"Git provider to sync"}},"required":["provider"]}}}},"responses":{"200":{"description":"Synced git namespaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitNamespace"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/git-namespaces/{id}/repositories":{"get":{"operationId":"listGitNamespaceRepositories","description":"List repositories accessible through a git namespace (GitHub installation).","x-speakeasy-group":"user","x-speakeasy-name-override":"listGitNamespaceRepositories","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","description":"Search query to filter repositories by name"},"required":false,"description":"Search query to filter repositories by name","name":"search","in":"query"}],"responses":{"200":{"description":"List of repositories.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/GitRepository"}}},"required":["items"]}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Git namespace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/pending":{"get":{"operationId":"getPendingWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$"},"required":true,"name":"workspace","in":"query"}],"responses":{"200":{"description":"An active invitation addressed to the signed-in user for this workspace, if any.","content":{"application/json":{"schema":{"type":"object","properties":{"invitationId":{"type":"string","nullable":true,"pattern":"winv_[0-9a-zA-Z]{32}$","description":"Unique identifier for the workspace invitation.","example":"winv_DsgltMIFV0GmqtxV5NYTtrknrna"}},"required":["invitationId"]}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/user/invitations/{token}/accept":{"post":{"operationId":"acceptWorkspaceInvitation","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"token","in":"path"}],"responses":{"200":{"description":"Invitation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AcceptWorkspaceInvitationResponse"}}}},"404":{"description":"Invitation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/whoami":{"get":{"operationId":"whoami","description":"Get the current authenticated principal (user or service account). Works with both session cookies and API keys.","x-speakeasy-group":"auth","x-speakeasy-name-override":"whoami","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","example":"my-workspace"},"required":false,"description":"Workspace to resolve the principal in. Required for user credentials because a user's role is per-workspace. Service accounts carry their workspace in the credential and may omit it.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current authenticated principal.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Subject"}}}},"400":{"description":"Missing required workspace for user credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized - no valid authentication provided.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export":{"get":{"operationId":"getProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Configuration and delivery status; headers are never returned.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string","maxLength":2048,"format":"uri"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}}},"required":["endpoint","enabled"]}}}},"responses":{"200":{"description":"Saved configuration. Changes take effect within 30 seconds.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/log-export/test":{"post":{"operationId":"testProjectLogExport","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Result of sending one test log to the saved destination.","content":{"application/json":{"schema":{"type":"object","properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headersConfigured":{"type":"boolean"},"revision":{"type":"string","nullable":true},"lastSuccessAt":{"type":"string","nullable":true,"format":"date-time"},"lastErrorAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["endpoint","enabled","headersConfigured","revision","lastSuccessAt","lastErrorAt","lastError"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}":{"get":{"operationId":"getLogExportDeliveryConfig","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"responses":{"200":{"description":"Private runtime configuration for the assigned manager.","content":{"application/json":{"schema":{"type":"object","nullable":true,"properties":{"endpoint":{"type":"string"},"enabled":{"type":"boolean"},"headers":{"type":"object","additionalProperties":{"type":"string","maxLength":8192,"pattern":"^[\\t\\x20-\\x7e]*$"}},"revision":{"type":"string"},"updatedAt":{"type":"string","format":"date-time"}},"required":["endpoint","enabled","headers","revision","updatedAt"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/log-export/{id}/status":{"post":{"operationId":"reportLogExportDelivery","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"revision":{"type":"string"},"succeeded":{"type":"boolean"},"error":{"type":"string","nullable":true,"enum":["timeout","connection","destination-rejected","invalid-destination","overflow",null]},"statusCode":{"type":"integer","nullable":true,"minimum":100,"maximum":599}},"required":["revision","succeeded","error"]}}}},"responses":{"200":{"description":"Delivery status recorded for the current configuration revision.","content":{"application/json":{"schema":{"type":"object","properties":{"accepted":{"type":"boolean"}},"required":["accepted"]}}}},"400":{"description":"Invalid configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces":{"get":{"operationId":"listWorkspaces","description":"Retrieve all workspaces.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search workspaces by name"},"required":false,"description":"Search workspaces by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved workspaces.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Workspace"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}":{"get":{"operationId":"getWorkspace","description":"Retrieve a workspace by ID.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved workspace.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspace","description":"Update a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"logoUrl":{"type":"string","nullable":true,"maxLength":2048,"format":"uri"}}}}}},"responses":{"200":{"description":"Workspace updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Workspace"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteWorkspace","description":"Delete a workspace. The workspace must have no projects.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Workspace deleted successfully."},"400":{"description":"Workspace still has projects.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members":{"get":{"operationId":"listWorkspaceMembers","description":"List all members of a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"listMembers","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"List of workspace members.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceMember"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"addWorkspaceMember","description":"Add a member to a workspace by email. The user must already have an account.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"addMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email","description":"Email of the user to add"},"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"Role to assign"}]}},"required":["email","role"]}}}},"responses":{"201":{"description":"Member added successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"404":{"description":"Workspace or user not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"User is already a member.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/members/{userId}":{"patch":{"operationId":"updateWorkspaceMember","description":"Update a workspace member's role.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"allOf":[{"$ref":"#/components/schemas/WorkspaceRole"},{"description":"New role to assign"}]}},"required":["role"]}}}},"responses":{"200":{"description":"Member role updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceMember"}}}},"400":{"description":"Cannot remove last admin.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"removeWorkspaceMember","description":"Remove a member from a workspace.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"removeMember","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"userId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Member removed successfully."},"400":{"description":"Cannot remove last admin or self.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace or member not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/settings":{"get":{"operationId":"getWorkspaceSettings","description":"Read the ai-agent settings for a workspace. Returns defaults (`enabled: true`) when the workspace has never customized them.","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"getSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateWorkspaceSettings","description":"Update the ai-agent settings for a workspace. Supports `enabled` (`false` turns the ai-agent off so incoming triggers are rejected before any session runs).","x-speakeasy-group":"workspaces","x-speakeasy-name-override":"updateSettings","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateWorkspaceSettingsRequest"}}}},"responses":{"200":{"description":"Updated ai-agent settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSettings"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations":{"get":{"operationId":"listWorkspaceInvitations","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Pending invitations.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceInvitation"}}},"required":["items"]}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"email":{"type":"string","format":"email"},"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["email","role"]}}}},"responses":{"201":{"description":"Invitation created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"403":{"description":"Seat limit reached.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Invitation already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}/resend":{"post":{"operationId":"resendWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Invitation email sent again.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInvitation"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invitations/{invitationId}":{"delete":{"operationId":"revokeWorkspaceInvitation","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"invitationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invitation revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/workspaces/{id}/invite-link":{"get":{"operationId":"getWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Active invite link.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"createWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"$ref":"#/components/schemas/WorkspaceRole"}},"required":["role"]}}}},"responses":{"200":{"description":"Invite link created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceInviteLink"}}}},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeWorkspaceInviteLink","parameters":[{"schema":{"type":"string","pattern":"ws_[0-9a-zA-Z]{24}$","description":"Unique identifier for the workspace.","example":"ws_It13CUaGEhLLAB87simX0"},"required":true,"description":"Unique identifier for the workspace.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Invite link revoked."},"404":{"description":"Workspace not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects":{"get":{"operationId":"listProjects","description":"Retrieve all projects.","x-speakeasy-group":"projects","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Search projects by name"},"required":false,"description":"Search projects by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deploymentCount","latestRelease"]},"description":"Optional fields to include: deploymentCount, latestRelease"},"required":false,"description":"Optional fields to include: deploymentCount, latestRelease","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved projects.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ProjectListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createProject","description":"Create a new project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"gitRepository":{"type":"object","nullable":true,"properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false,"description":"Verified source repository connected to the project. Alien uses this for GitHub Actions setup and source-aware features; releases are still created explicitly by CI or `alien release`."},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"},"enabledCapabilities":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"minItems":1,"maxItems":5}},"required":["name"]}}}},"responses":{"201":{"description":"Project created successfully.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"}}}]}}}},"400":{"description":"Invalid request or GitHub repository connection failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}":{"get":{"operationId":"getProject","description":"Retrieve a project by ID or name.","x-speakeasy-group":"projects","x-speakeasy-name-override":"get","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateProject","description":"Update a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"update","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProject"}}}},"responses":{"200":{"description":"Project updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Project"}}}},"403":{"description":"Project update permission is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this project's release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request or package settings are invalid or incomplete.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteProject","description":"Delete a project. The project must have no deployments.","x-speakeasy-group":"projects","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Project deleted successfully."},"400":{"description":"Project still has deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/gcp-oauth-provider":{"get":{"operationId":"getProjectGcpOAuthProvider","description":"Retrieve redacted project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateProjectGcpOAuthProvider","description":"Update project-level Google Cloud OAuth provider settings.","x-speakeasy-group":"projects","x-speakeasy-name-override":"updateGcpOAuthProvider","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateProjectGcpOAuthProvider"}}}},"responses":{"200":{"description":"Google Cloud OAuth provider settings updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectGcpOAuthProvider"}}}},"400":{"description":"Invalid provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/source":{"post":{"operationId":"configureProjectSource","description":"Connect a GitHub repository or Alien template to an existing project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureSource","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["repository"]},"gitRepository":{"type":"object","properties":{"type":{"type":"string","enum":["github"],"description":"The Git Provider of the repository","example":"github"},"repo":{"type":"string","maxLength":128,"description":"The name of the git repository","example":"alien/my-agent"}},"required":["type","repo"],"additionalProperties":false},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","gitRepository"]},{"type":"object","properties":{"mode":{"type":"string","enum":["template"]},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"}},"required":["mode","targetNamespace","templatePath"]}]}}}},"responses":{"200":{"description":"Project source connected.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}}}]}}}},"400":{"description":"Repository or template configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Template fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-portal-domain":{"get":{"operationId":"getProjectDeploymentPortalDomain","description":"Get the deployment portal domain binding for a project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentPortalDomain","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment portal domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentPortalDomainResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/import-template":{"post":{"operationId":"createProjectFromTemplate","description":"Create a project by forking alienplatform/alien into your namespace.","x-speakeasy-group":"projects","x-speakeasy-name-override":"createFromTemplate","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!prj[-_])[a-z0-9](-?[a-z0-9])*$","description":"Project name.","example":"my-app"},"targetNamespace":{"type":"string","minLength":1,"maxLength":100,"pattern":"^[a-zA-Z0-9-]+$","description":"GitHub owner namespace (user or organization) that will receive the fork"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"rootDirectory":{"type":"string","nullable":true,"maxLength":256,"description":"The name of a directory or relative path to the source code of your project. When null is used it will default to the project root"},"packagesConfig":{"type":"object","nullable":true,"properties":{"cli":{"type":"object","nullable":true,"properties":{"binaryTargets":{"type":"array","items":{"type":"string","enum":["windows-x64","linux-x64","linux-arm64","darwin-arm64"],"description":"Target OS and architecture for compiled binaries.\n\nUsed as keys in package output maps (CLI binaries, Terraform providers, etc.)\nand for cross-compilation target selection during builds."},"description":"Binary targets required by this package's setup consumer.\n\nOlder package rows omit this field and retain the historical all-target\nbehavior. Callers creating new packages should state their target set."},"displayName":{"type":"string","description":"Human-friendly display name for help banners and about text"},"name":{"type":"string","description":"Binary name displayed in help and usage (e.g., \"acmectl\")"},"enabled":{"type":"boolean","description":"Whether CLI package generation is enabled"}},"required":["displayName","name","enabled"],"description":"CLI package configuration. If null, CLI packages will not be generated."},"cloudformation":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether CloudFormation package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"CloudFormation package configuration. If null, CloudFormation packages will not be generated."},"operatorImage":{"type":"object","nullable":true,"properties":{"brand":{"type":"string","nullable":true,"description":"Short brand slug used for generated resource names."},"displayName":{"type":"string","description":"Human-friendly display name for logs and startup messages"},"envPrefix":{"type":"string","nullable":true,"description":"Branded environment variable prefix (e.g., \"ACME\")."},"labelDomain":{"type":"string","nullable":true,"description":"Branded Kubernetes/cloud label domain (e.g., \"acme.dev\")."},"name":{"type":"string","description":"Image name (e.g., \"acme-operator\")"},"enabled":{"type":"boolean","description":"Whether Operator image package generation is enabled"}},"required":["displayName","name","enabled"],"description":"Operator image package configuration. Required when Helm is enabled. If null, Operator image packages will not be generated."},"helm":{"type":"object","nullable":true,"properties":{"chartName":{"type":"string","description":"Chart name (e.g., \"acme-operator\")"},"description":{"type":"string","description":"Human-friendly description of the chart"},"logCollector":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether logs are collected by default; installers can override this value."},"mode":{"type":"string","enum":["podApi","nodeAgent"],"description":"Kubernetes log collection mechanism."}},"required":["enabled","mode"],"description":"Default log collection mode in a generated Helm chart."},"enabled":{"type":"boolean","description":"Whether Helm chart package generation is enabled"},"setupResources":{"type":"object","properties":{"tokenSecret":{"type":"object","properties":{"key":{"type":"string","pattern":"^[a-zA-Z0-9_.-]{1,63}$"},"name":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"},"prefix":{"type":"string","pattern":"^[a-zA-Z0-9_]{1,32}$"},"randomLength":{"type":"integer","minimum":16,"maximum":64}},"required":["key","name","prefix","randomLength"]},"workloadReadAccess":{"type":"object","properties":{"rules":{"type":"array","items":{"type":"object","properties":{"apiGroup":{"type":"string","pattern":"^(?:|apps|networking\\.k8s\\.io)$","description":"Kubernetes API group: empty for core resources, apps, or networking.k8s.io."},"resources":{"type":"array","items":{"type":"string","minLength":1},"minItems":1,"maxItems":32}},"required":["apiGroup","resources"]},"minItems":1,"maxItems":16},"serviceAccountProfile":{"type":"string","pattern":"^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"}},"required":["rules","serviceAccountProfile"]}},"required":["tokenSecret","workloadReadAccess"]},"runtimePersistence":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Persist operator identity across restarts."},"existingClaim":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"},"size":{"type":"string","maxLength":32,"pattern":"^(?=[0-9.]*[1-9])(?:[0-9]+(?:\\.[0-9]*)?|\\.[0-9]+)(?:[KMGTPE]i|[kMGTPEmun]|[eE][+-]?[0-9]+)?$"},"storageClassName":{"type":"string","maxLength":253,"pattern":"^$|^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$"}},"required":["enabled","existingClaim","size","storageClassName"]}},"required":["chartName","description","enabled"],"description":"Helm chart package configuration. If null, Helm packages will not be generated."},"terraform":{"type":"object","nullable":true,"properties":{"enabled":{"type":"boolean","description":"Whether Terraform package generation is enabled"},"displayName":{"type":"string","nullable":true,"description":"Human-friendly application name shown in generated install artifacts"}},"required":["enabled"],"description":"Terraform package configuration. If null, Terraform packages will not be generated."}},"description":"Configuration for embedded packages (CLI, CloudFormation, Helm, Terraform)"}},"required":["name","targetNamespace","templatePath"]}}}},"responses":{"201":{"description":"Project created successfully from template.","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Project"},{"type":"object","properties":{"githubSetup":{"type":"object","properties":{"pullRequestUrl":{"type":"string","format":"uri","description":"URL to the pull request with the Alien build workflow"},"workflowUrl":{"type":"string","format":"uri","description":"URL to the GitHub Actions workflow"}},"required":["pullRequestUrl","workflowUrl"]},"gitRepositoryWarning":{"$ref":"#/components/schemas/APIError"},"template":{"type":"object","properties":{"sourceRepository":{"type":"string","enum":["alienplatform/alien"]},"forkRepository":{"type":"string","description":"Fork repository in <owner>/<repo> format"},"templatePath":{"type":"string","enum":["examples/customer-models-ts","examples/remote-worker-ts","examples/github-agent/packages/remote-agent","examples/endpoint-agent","examples/byoc-database"],"description":"Template root directory inside alienplatform/alien"},"resolvedRootDirectory":{"type":"string"}},"required":["sourceRepository","forkRepository","templatePath","resolvedRootDirectory"]}},"required":["template"]}]}}}},"400":{"description":"Bad request or GitHub integration not installed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Project name already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Fork exists but is not ready yet.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/template-urls":{"get":{"operationId":"getProjectTemplateUrls","description":"Get template URLs for deploying setup stacks in this project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getTemplateUrls","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Template URLs retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"aws":{"type":"object","nullable":true,"properties":{"templateUrl":{"type":"string","format":"uri","description":"URL to download the CloudFormation template"},"launchStackUrl":{"type":"string","format":"uri","description":"URL to launch the template in the AWS CloudFormation console"}},"required":["templateUrl","launchStackUrl"],"description":"Template URLs for deploying an AWS setup stack"}}}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/deployment-link-setup":{"get":{"operationId":"getProjectDeploymentLinkSetup","description":"Get the active release stack and portal-visible setup availability for deployment-link configuration.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getDeploymentLinkSetup","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment-link setup retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentLinkSetupResponse"}}}},"400":{"description":"The project's sandbox follows an Alien default image this environment does not configure.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or active release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/active-release":{"get":{"operationId":"getProjectActiveRelease","description":"Get the production channel's current release. When deploymentId is provided, returns that deployment's effective release: its pin, or its followed channel's current release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getActiveRelease","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","description":"Optional deployment ID to check for pinned release"},"required":false,"description":"Optional deployment ID to check for pinned release","name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Effective release retrieved successfully.","content":{"application/json":{"schema":{"nullable":true}}}},"404":{"description":"Project or effective release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models/impact":{"post":{"operationId":"previewProjectModelsImpact","description":"Preview which customer model connections a configuration change may affect.","x-speakeasy-group":"projects","x-speakeasy-name-override":"previewModelsImpact","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Model configuration impact.","content":{"application/json":{"schema":{"type":"object","properties":{"connectedCustomers":{"type":"integer","minimum":0},"affectedCustomers":{"type":"integer","minimum":0},"verificationNeeded":{"type":"integer","minimum":0},"affected":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true},"provider":{"type":"string"},"reason":{"type":"string","enum":["provider-no-longer-compatible","required-model-not-in-catalog"]}},"required":["deploymentGroupId","name","externalId","provider","reason"]}},"truncated":{"type":"boolean"}},"required":["connectedCustomers","affectedCustomers","verificationNeeded","affected","truncated"]}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities":{"put":{"operationId":"setProjectCapabilities","description":"Set the capabilities offered by a Project. Removing a capability prevents new setup without deleting existing customer resources.","x-speakeasy-group":"projects","x-speakeasy-name-override":"setCapabilities","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"array","items":{"type":"string","enum":["deployments","models","keys","buckets","registry"]},"maxItems":5}},"required":["enabled"],"additionalProperties":false}}}},"responses":{"200":{"description":"The Project's enabled capabilities.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/deployments":{"put":{"operationId":"configureProjectDeployments","description":"Enable deployments for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureDeployments","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"boolean","enum":[true]},"methods":{"type":"array","items":{"type":"string","enum":["framework","remote-operator"]},"minItems":1,"maxItems":2}},"required":["enabled","methods"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployments enabled for the Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilities"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-provider-headers":{"get":{"operationId":"getProjectAiProviderHeaders","description":"Get static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Static AI provider headers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"configureProjectAiProviderHeaders","description":"Replace the static headers added to AI requests for each provider.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureAiProviderHeaders","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"responses":{"200":{"description":"Static AI provider headers updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AIProviderHeaders"}}}},"400":{"description":"Provider header configuration is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/models":{"put":{"operationId":"configureProjectModels","description":"Configure customer-owned model providers without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureModels","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureModelsRequest"}}}},"responses":{"200":{"description":"Customer Models configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/keys":{"put":{"operationId":"configureProjectKeys","description":"Enable customer-owned application encryption without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"applicationEncryption":{"type":"boolean","enum":[true]}},"required":["applicationEncryption"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Key configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/buckets":{"put":{"operationId":"configureProjectBuckets","description":"Enable buckets without requiring a project Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureBuckets","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"access":{"type":"string","enum":["read-write"]}},"required":["access"],"additionalProperties":false}}}},"responses":{"200":{"description":"Buckets configured and their exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/registry":{"put":{"operationId":"configureProjectRegistry","description":"Enable customer-owned container registries without requiring an application Release.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRegistry","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"repositories":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128},"maxItems":100},"credentialPolicy":{"type":"string","enum":["pull-only","push-and-pull"]}},"required":["repositories","credentialPolicy"],"additionalProperties":false}}}},"responses":{"200":{"description":"Customer Registry configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox":{"put":{"operationId":"configureProjectRemoteSandbox","description":"Enable a customer-owned sandbox a hosted caller can drive through Remote Bindings. Without a custom image it publishes to every cloud on Alien's default image, which the project then follows. A custom image publishes to AWS; a public one with a linux/amd64 variant also publishes to Azure, and to GCP once Alien has built its GCP image.","x-speakeasy-group":"projects","x-speakeasy-name-override":"configureRemoteSandbox","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ConfigureRemoteSandboxRequest"}}}},"responses":{"200":{"description":"Sandbox configured and its exact setup source materialized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CapabilityMaterialization"}}}},"400":{"description":"The sandbox configuration cannot be satisfied by this environment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The Project's capabilities changed concurrently; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The request body is invalid, including a per-cloud field.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The image's registry or Alien's GCP image service could not be reached, or the save's GCP image could not be queued; retry the request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/remote-sandbox/base-image-repository":{"post":{"operationId":"ensureProjectSandboxBaseImageRepository","description":"Ensure the project's private image repository exists and return where to push a private sandbox base image. Name the pushed image as the remote sandbox base image afterwards.","x-speakeasy-group":"projects","x-speakeasy-name-override":"ensureSandboxBaseImageRepository","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Repository ready to receive a push.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SandboxBaseImageRepository"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found, or no AWS manager serves it.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager could not prepare the repository.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The project's manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/project-capabilities/overview":{"get":{"operationId":"getProjectCapabilityOverview","description":"Get safe, server-derived capability status for a Project.","x-speakeasy-group":"projects","x-speakeasy-name-override":"getCapabilityOverview","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Project capability overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ProjectCapabilityOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-bindings/access":{"post":{"operationId":"createRemoteBindingsExternalAccess","tags":["remote-bindings"],"summary":"Create short-lived Remote Bindings access for a external resource","description":"Selects a connected external resource by Project and external ID, then returns a short-lived deployment-scoped Manager capability. The caller never receives the external cloud credentials from Platform.","x-speakeasy-group":"remoteBindings","x-speakeasy-name-override":"createExternalAccess","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessRequest"}}}},"responses":{"200":{"description":"Short-lived Remote Bindings access was created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoteBindingsExternalAccessResponse"}}}},"401":{"description":"The API key is missing, invalid, expired, or disabled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot access Remote Bindings for this Project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The Project or external ID was not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"More than one active external resource matched.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The external resource or its assigned Manager is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary":{"get":{"operationId":"getRemoteOperatorProjectSummary","tags":["projects"],"summary":"Get the authoritative Remote Operator project summary","x-speakeasy-group":"projects","x-speakeasy-name-override":"getRemoteOperatorSummary","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Authoritative Remote Operator state composed from existing owners.","content":{"application/json":{"schema":{"type":"object","properties":{"generatedAt":{"type":"string","format":"date-time"},"project":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"}},"required":["id","name"]},"nextAction":{"type":"object","properties":{"kind":{"type":"string","enum":["connect","inspect","reconnect","verify","update","wait","none"]},"target":{"type":"string","enum":["setup","deployment","releases","access","operations","activity"]},"deploymentId":{"type":"string","nullable":true},"message":{"type":"string"}},"required":["kind","target","deploymentId","message"]},"installations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroupId":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs","unknown"]},"region":{"type":"string","nullable":true},"state":{"type":"string","enum":["unhealthy","stale","connecting","unverified","verified"]},"stateReason":{"type":"string"},"status":{"type":"string"},"lastHeartbeatAt":{"type":"string","nullable":true,"format":"date-time"},"lastSuccessfulDiagnosticAt":{"type":"string","nullable":true,"format":"date-time"},"operatorVersion":{"type":"string","nullable":true},"operatorScope":{"type":"string","nullable":true},"operatorPermission":{"type":"string","nullable":true},"expectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"previousExpectedImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"},"runningImage":{"$ref":"#/components/schemas/ObservedRemoteOperatorImageIdentity"},"imageStatus":{"type":"string","enum":["matching","drifted","unreported","unconfigured"]},"operatorUpdate":{"type":"object","nullable":true,"properties":{"packageId":{"type":"string"},"packageVersion":{"type":"string"},"image":{"type":"string"},"digest":{"type":"string"},"builtAt":{"type":"string","format":"date-time"}},"required":["packageId","packageVersion","image","digest","builtAt"],"description":"The ready Operator image selected by the project's current configuration when it differs from the image this installation was set up with. Re-applying setup installs it. Null when the installation already uses it, its install identity is unknown, or the selected package is not ready."},"operationSync":{"type":"object","nullable":true,"properties":{"status":{"type":"string","enum":["preparing","syncing","ready","stuck"]},"targetBundleHash":{"type":"string"},"observedBundleHash":{"type":"string","nullable":true},"targetSetAt":{"type":"string","format":"date-time"},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"string","nullable":true}},"required":["status","targetBundleHash","observedBundleHash","targetSetAt","observedAt","error"]},"application":{"type":"object","properties":{"state":{"type":"string","enum":["no-desired","up-to-date","update-required","unknown","failed"],"description":"How the application release the Operator reports compares with the desired release. Alien never applies the change; the customer applies it through their own release process."},"reason":{"type":"string"},"reported":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The application release the Operator reports"},"desired":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["channel","pin"]},"helmChart":{"type":"object","nullable":true,"properties":{"chart":{"type":"string"},"version":{"type":"string"}},"required":["chart","version"],"description":"The Helm chart built for this release, when the release has one"},"images":{"type":"array","items":{"type":"string"},"description":"Container images the release records for AWS, in resource order"}},"required":["releaseId","version","source","helmChart","images"],"description":"The release the deployment should run: its pinned release or its channel's release"},"releaseChannel":{"type":"string","description":"The release channel the deployment follows when unpinned"},"rollback":{"type":"object","nullable":true,"properties":{"releaseId":{"type":"string"},"version":{"type":"string"}},"required":["releaseId","version"],"description":"The release the deployment reported before it moved to the desired release"}},"required":["state","reason","reported","desired","releaseChannel","rollback"]},"permissions":{"type":"object","properties":{"status":{"type":"string","enum":["current","outdated","unknown"],"description":"Whether the Kubernetes RBAC and cloud IAM recorded for this installation match the permissions compiled from the currently enabled operations."},"recordedAt":{"type":"string","nullable":true,"format":"date-time","description":"When setup was issued or last re-applied; null when nothing was recorded."},"reason":{"type":"string"}},"required":["status","recordedAt","reason"],"description":"Installed cloud and Kubernetes permissions. Setup applies them, so enabling or disabling operations changes them only after the installation's setup is re-applied."}},"required":["id","name","deploymentGroupId","platform","region","state","stateReason","status","lastHeartbeatAt","lastSuccessfulDiagnosticAt","operatorVersion","operatorScope","operatorPermission","expectedImage","previousExpectedImage","runningImage","imageStatus","operatorUpdate","operationSync","application","permissions"]}},"unregisteredSetups":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"platform":{"type":"string","enum":["kubernetes","ecs"]},"createdAt":{"type":"string","format":"date-time"},"valuesExpireAt":{"type":"string","nullable":true,"format":"date-time","description":"When the newest installation values stop working. Resuming setup can replace them."}},"required":["deploymentGroupId","name","platform","createdAt","valuesExpireAt"]},"description":"Setups whose installation values were created but whose Operator never registered, newest first."}},"required":["items","unregisteredSetups"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"release":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"reported":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"deployments":{"type":"integer","minimum":0,"exclusiveMinimum":true},"latest":{"type":"boolean"}},"required":["releaseId","version","createdAt","deployments","latest"]},"description":"Application releases that Remote Operator deployments report, newest first. The newest reported release is latest."},"older":{"type":"integer","minimum":0,"description":"Deployments without a desired release that report a release older than the latest reported release"},"unknown":{"type":"integer","minimum":0,"description":"Deployments that report no application release"},"rollout":{"type":"array","items":{"type":"object","properties":{"releaseId":{"type":"string"},"version":{"type":"string"},"upToDate":{"type":"integer","minimum":0},"waiting":{"type":"integer","minimum":0},"unknown":{"type":"integer","minimum":0},"failed":{"type":"integer","minimum":0}},"required":["releaseId","version","upToDate","waiting","unknown","failed"]},"description":"Desired releases, most deployments first, with how many Remote Operator deployments run each one, still need the change, report no release, or failed after it"}},"required":["reported","older","unknown","rollout"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"access":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"pending":{"type":"integer","minimum":0},"active":{"type":"integer","minimum":0},"recent":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"title":{"type":"string"},"status":{"type":"string","enum":["pending-approval","queued","customer-approved","expired","rejected","revoked"]},"approvedUntil":{"type":"string","nullable":true,"format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","title","status","approvedUntil","updatedAt"]}}},"required":["pending","active","recent"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"operations":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"selected":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"},"source":{"type":"string","enum":["builtin","custom"]},"operations":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]}},"required":["name","tier"]}}},"required":["name","version","source","operations"]}},"sync":{"type":"object","properties":{"preparing":{"type":"integer","minimum":0},"syncing":{"type":"integer","minimum":0},"ready":{"type":"integer","minimum":0},"stuck":{"type":"integer","minimum":0}},"required":["preparing","syncing","ready","stuck"]},"generatedPermissions":{"type":"array","items":{"type":"object","properties":{"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","enum":["read-only","mutating","destructive"]},"cloud":{"type":"object","properties":{"azure":{"type":"array","items":{"type":"string"},"maxItems":0,"description":"Always empty: Azure resource operations are not supported yet because no Azure resource permission has been reviewed for operations. Kubernetes API permissions are separate."},"aws":{"type":"array","items":{"type":"object","properties":{"effect":{"type":"string","enum":["Allow","Deny"]},"actions":{"type":"array","items":{"type":"string"}},"resources":{"type":"array","items":{"type":"string"}},"condition":{"type":"object","nullable":true,"additionalProperties":{"type":"object","additionalProperties":{"type":"string"}}},"reason":{"type":"string"}},"required":["effect","actions","resources","condition","reason"]}},"gcp":{"type":"array","items":{"type":"object","properties":{"permissions":{"type":"array","items":{"type":"string"}},"scope":{"type":"string","enum":["projects/${projectName}","projects/${projectName}/buckets/${resourceName}"]},"reason":{"type":"string"}},"required":["permissions","scope","reason"]}}},"required":["azure","aws","gcp"],"description":"Cloud permissions required to execute this operation."},"kubernetes":{"$ref":"#/components/schemas/OperationsCatalogKubernetesPermissions"}},"required":["plugin","pluginVersion","operation","tier","cloud"]}}},"required":["selected","sync","generatedPermissions"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]},"activity":{"type":"object","properties":{"status":{"type":"string","enum":["ready","empty","error","unavailable"]},"freshness":{"type":"string","enum":["fresh","stale","unknown"]},"sourceUpdatedAt":{"type":"string","nullable":true,"format":"date-time"},"error":{"type":"object","nullable":true,"properties":{"code":{"type":"string"},"message":{"type":"string"}},"required":["code","message"]},"data":{"type":"object","nullable":true,"properties":{"recent":{"type":"array","items":{"type":"object","properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string","nullable":true},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","nullable":true},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt"]}},"investigations":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"triggerType":{"type":"string"},"deploymentId":{"type":"string"},"status":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","triggerType","deploymentId","status","createdAt","updatedAt"]},"description":"Recent agent sessions about Remote Operator deployments or their access requests"},"debugSessions":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"deploymentId":{"type":"string"},"state":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"expiresAt":{"type":"string","format":"date-time"}},"required":["id","deploymentId","state","createdAt","expiresAt"]}},"lastVerifiedOperation":{"type":"object","nullable":true,"properties":{"invocationId":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"commandId":{"type":"string"},"plugin":{"type":"string"},"pluginVersion":{"type":"string"},"operation":{"type":"string"},"tier":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null]},"accessRequestId":{"type":"string","nullable":true},"commandState":{"type":"string","enum":["SUCCEEDED"]},"verificationState":{"type":"string","enum":["not-required","pending","verified","failed","skipped"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"},"verification":{"type":"object","properties":{"state":{"type":"string","enum":["not-required","verified","skipped"]},"attempts":{"type":"integer","minimum":0},"maxAttempts":{"type":"integer","minimum":0},"deadline":{"type":"string","nullable":true,"format":"date-time"},"reason":{"type":"string","nullable":true}},"required":["state","attempts","maxAttempts","deadline","reason"]},"sensitiveOutput":{"oneOf":[{"type":"object","properties":{"kind":{"type":"string","enum":["none"]}},"required":["kind"]},{"type":"object","properties":{"kind":{"type":"string","enum":["redact"]},"fields":{"type":"array","items":{"type":"string"}}},"required":["kind","fields"]},{"type":"object","properties":{"kind":{"type":"string","enum":["requireConfirmation"]}},"required":["kind"]}]},"resultAvailable":{"type":"boolean"},"result":{"nullable":true},"completedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["invocationId","deploymentId","commandId","plugin","pluginVersion","operation","tier","accessRequestId","commandState","verificationState","createdAt","updatedAt","verification","sensitiveOutput","resultAvailable","completedAt"]}},"required":["recent","investigations","debugSessions","lastVerifiedOperation"]}},"required":["status","freshness","sourceUpdatedAt","error","data"]}},"required":["generatedAt","project","nextAction","installations","release","access","operations","activity"]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-image":{"post":{"operationId":"acceptRemoteOperatorImage","tags":["projects"],"summary":"Accept a reported image for a Remote Operator installation","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorImage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"responses":{"200":{"description":"The observed immutable image is now the accepted desired image.","content":{"application/json":{"schema":{"type":"object","properties":{"operatorImage":{"$ref":"#/components/schemas/RemoteOperatorInstallReceipt"}},"required":["operatorImage"]}}}},"400":{"description":"The deployment is not a Remote Operator installation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The requested image is not the image in the latest Operator heartbeat.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/remote-operator-summary/installations/{deploymentId}/accept-permissions":{"post":{"operationId":"acceptRemoteOperatorPermissions","tags":["projects"],"summary":"Record that a Remote Operator installation's setup was re-applied","description":"Records the permissions compiled from the currently enabled operations as the installation's installed permissions. Call it after re-applying the installation's Helm release, manifest, cloud access, or CloudFormation stack.","x-speakeasy-group":"projects","x-speakeasy-name-override":"acceptRemoteOperatorPermissions","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"deploymentId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"reviewedPermissions":{"type":"array","items":{"$ref":"#/components/schemas/RemoteOperatorPermissionPlugin"},"description":"The enabled operations' permission declarations that the owner reviewed and re-applied."}},"required":["reviewedPermissions"]}}}},"responses":{"200":{"description":"The current permissions are recorded as installed.","content":{"application/json":{"schema":{"type":"object","properties":{"recordedAt":{"type":"string","format":"date-time"}},"required":["recordedAt"]}}}},"400":{"description":"The deployment is not a Kubernetes or ECS Remote Operator installation, or an enabled operation is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The enabled operations changed after the reviewed permissions were loaded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/ai-metrics":{"get":{"operationId":"getProjectAiUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getAiUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe AI Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"pricing":{"type":"object","properties":{"label":{"type":"string","enum":["Estimated provider cost"]},"coverage":{"type":"number","minimum":0,"maximum":1},"revision":{"type":"string","nullable":true}},"required":["label","coverage","revision"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"deploymentGroupId":{"type":"string"},"name":{"type":"string"},"externalId":{"type":"string","nullable":true}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","deploymentGroupId","name","externalId"]}},"models":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"inputTokens":{"type":"integer","nullable":true,"minimum":0},"outputTokens":{"type":"integer","nullable":true,"minimum":0},"estimatedCostMicrousd":{"type":"integer","nullable":true,"minimum":0},"pricedRequests":{"type":"integer","minimum":0},"publicModel":{"type":"string"},"provider":{"type":"string"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","inputTokens","outputTokens","estimatedCostMicrousd","pricedRequests","publicModel","provider"]}},"customersTruncated":{"type":"boolean"},"modelsTruncated":{"type":"boolean"}},"required":["status","range","pricing","totals","timeSeries","customers","models","customersTruncated","modelsTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/encryption-metrics":{"get":{"operationId":"getProjectEncryptionUsage","x-speakeasy-group":"projects","x-speakeasy-name-override":"getEncryptionUsage","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Encryption Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","bucket"]}},"operations":{"type":"array","items":{"type":"object","properties":{"requests":{"type":"integer","minimum":0},"successfulRequests":{"type":"integer","minimum":0},"errorRequests":{"type":"integer","minimum":0},"averageLatencyMs":{"type":"number","nullable":true,"minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"operation":{"type":"string","enum":["encrypt","decrypt"]}},"required":["requests","successfulRequests","errorRequests","averageLatencyMs","p95LatencyMs","operation"]}}},"required":["status","range","totals","timeSeries","operations"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/projects/{idOrName}/sandbox-metrics":{"get":{"operationId":"getProjectSandboxMetrics","x-speakeasy-group":"projects","x-speakeasy-name-override":"getSandboxMetrics","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNamePathParam"},"required":true,"description":"Project ID or name.","name":"idOrName","in":"path","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["24h","7d","30d"],"default":"24h"},"required":false,"name":"range","in":"query"}],"responses":{"200":{"description":"Privacy-safe Sandbox Gateway usage aggregates.","content":{"application/json":{"schema":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["unavailable"]},"reason":{"type":"string","enum":["not-configured","temporarily-unavailable"]}},"required":["status","reason"]},{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"range":{"type":"string","enum":["24h","7d","30d"]},"totals":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs"]},"timeSeries":{"type":"array","items":{"type":"object","properties":{"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"outcomeUnknown":{"type":"integer","minimum":0},"errors":{"type":"integer","minimum":0},"p95LatencyMs":{"type":"number","nullable":true,"minimum":0},"bucket":{"type":"string","format":"date-time"}},"required":["sessions","commands","outcomeUnknown","errors","p95LatencyMs","bucket"]}},"customers":{"type":"array","items":{"type":"object","properties":{"deploymentGroupId":{"type":"string"},"externalId":{"type":"string","nullable":true},"sessions":{"type":"integer","minimum":0},"commands":{"type":"integer","minimum":0},"lastSeenAt":{"type":"string","format":"date-time"}},"required":["deploymentGroupId","externalId","sessions","commands","lastSeenAt"]}},"customersTruncated":{"type":"boolean"}},"required":["status","range","totals","timeSeries","customers","customersTruncated"]}]}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups":{"post":{"operationId":"createDeploymentGroup","tags":["deployment-groups"],"summary":"Create a new deployment group","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group with this name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentGroups","tags":["deployment-groups"],"summary":"List deployment groups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of deployment groups","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"}}}]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-name":{"put":{"operationId":"ensureDeploymentGroupByName","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and name","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByNameRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/by-external-id":{"put":{"operationId":"ensureDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get or create a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EnsureDeploymentGroupByExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDeploymentGroupByExternalId","tags":["deployment-groups"],"summary":"Get a deployment group by project and external ID","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Optional for project-scoped API keys."},"required":false,"description":"Project ID or name. Optional for project-scoped API keys.","name":"project","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"},"required":true,"description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","name":"externalId","in":"query"}],"responses":{"200":{"description":"Deployment group returned successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Project or deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/setup-links":{"post":{"operationId":"createSetupLink","tags":["setup-links"],"summary":"Create a customer setup link","description":"Ensures the Deployment Group identified by Project and external ID, then creates a group-scoped setup link with exact captured sources.","x-speakeasy-group":"setupLinks","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkRequest"}}}},"responses":{"200":{"description":"Customer environment ensured and setup link created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupLinkResponse"}}}},"400":{"description":"Customer environment or setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Customer environment name or setup source conflicts","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}":{"get":{"operationId":"getDeploymentGroup","tags":["deployment-groups"],"summary":"Get deployment group details","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project"]},"description":"Optional fields to include: project"},"required":false,"description":"Optional fields to include: project","name":"include","in":"query"}],"responses":{"200":{"description":"Deployment group details","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentGroup"},{"type":"object","properties":{"project":{"type":"object","nullable":true,"properties":{"id":{"type":"string","description":"Project ID"},"name":{"type":"string","description":"Project name"}},"required":["id","name"],"description":"Project info, included when ?include=project is used"},"deploymentCount":{"type":"integer","description":"Current number of deployments in this deployment group"}},"required":["deploymentCount"]}]}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentGroup","tags":["deployment-groups"],"summary":"Update deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentGroupRequest"}}}},"responses":{"200":{"description":"Deployment group updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group name already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDeploymentGroup","tags":["deployment-groups"],"summary":"Delete deployment group","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Deployment group deleted successfully"},"400":{"description":"Cannot delete deployment group that has deployments","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/external-id":{"put":{"operationId":"setDeploymentGroupExternalId","tags":["deployment-groups"],"summary":"Set or clear a deployment group's external ID","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetDeploymentGroupExternalIdRequest"}}}},"responses":{"200":{"description":"Deployment group external ID updated successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentGroup"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment group external ID already exists in the project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/tokens":{"post":{"operationId":"createDeploymentGroupToken","tags":["deployment-groups"],"summary":"Create deployment group token","description":"Creates a deployment-group scoped API key and returns both the token and formatted deployment link","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenRequest"}}}},"responses":{"200":{"description":"Deployment group token created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentGroupTokenResponse"}}}},"400":{"description":"Deployment setup configuration is invalid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The project's sandbox configuration changed concurrently; retry the request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/first-party-session":{"post":{"operationId":"createFirstPartyDeploymentSession","tags":["deployment-groups"],"summary":"Create first-party deployment session","description":"Mints a short-lived deployment-group token with the recommended self-deploy policy for the authenticated developer.","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"First-party deployment session created successfully","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateFirstPartyDeploymentSessionResponse"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external":{"get":{"operationId":"getExternalAIBinding","tags":["deployment-groups"],"summary":"Get external AI connection state","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"External AI connection state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBindingState"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putExternalAIBinding","tags":["deployment-groups"],"summary":"Connect or rotate an external AI provider key","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutExternalAIBindingRequest"}}}},"responses":{"202":{"description":"External AI connection stored and queued for checking","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIBinding"}}}},"400":{"description":"The key is not valid for the selected provider","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The group already has an active cloud AI source","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Provider verification is temporarily unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteExternalAIBinding","tags":["deployment-groups"],"summary":"Revoke the external AI connection","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"External AI connection revoked"},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/models/{publicModelId}/checks":{"post":{"operationId":"createExternalAIModelCheck","tags":["deployment-groups"],"summary":"Queue an explicit external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1,"maxLength":256},"required":true,"name":"publicModelId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"The potentially billable model check was queued","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"400":{"description":"The model is not configured for this project","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or binding not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/ai/external/model-checks/{checkId}":{"get":{"operationId":"getExternalAIModelCheck","tags":["deployment-groups"],"summary":"Get an external model access check","parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string"},"required":true,"name":"checkId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Model check state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExternalAIModelCheck"}}}},"403":{"description":"Insufficient permissions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group or check not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry":{"get":{"operationId":"getContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Container registry state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryState"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"putContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"resourceId":{"type":"string","minLength":1,"maxLength":128}},"required":["deploymentId","resourceId"]}}}},"responses":{"200":{"description":"Registry route","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories":{"post":{"operationId":"createContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"}},"required":["name"]}}}},"responses":{"201":{"description":"Repository requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials":{"post":{"operationId":"createContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"label":{"type":"string","minLength":1,"maxLength":64},"scope":{"type":"string","enum":["pull","pushPull"]},"repositorySubset":{"type":"array","nullable":true,"items":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"minItems":1,"maxItems":100},"expiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["label","scope"]}}}},"responses":{"201":{"description":"Credential created; password is returned once","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateContainerRegistryCredentialResponse"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/credentials/{credentialId}":{"delete":{"operationId":"revokeContainerRegistryCredential","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crcred_[0-9a-z]{28}$","description":"Unique identifier for the container registry credential.","example":"crcred_oz1xjr82f37j17g4gtmyu"},"required":true,"description":"Unique identifier for the container registry credential.","name":"credentialId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Credential revoked"},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/repositories/{repositoryId}":{"delete":{"operationId":"deleteContainerRegistryRepository","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"required":true,"description":"Unique identifier for the container registry repository.","name":"repositoryId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"confirmName":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$"},"disposition":{"type":"string","enum":["preserve","deleteContents"]}},"required":["confirmName","disposition"]}}}},"responses":{"202":{"description":"Repository deletion requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"logicalName":{"type":"string"},"desiredState":{"type":"string","enum":["present","deleteRequested","deleted"]},"status":{"type":"string","enum":["pending","creating","ready","deleting","deleted","failed"]},"verifiedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["id","logicalName","desiredState","status","verifiedAt"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/verify":{"post":{"operationId":"verifyContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Verification requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-groups/{id}/container-registry/revoke":{"post":{"operationId":"revokeContainerRegistry","tags":["container-registry"],"parameters":[{"schema":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"required":true,"description":"Unique identifier for the deployment group.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Registry revocation requested","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"managerId":{"type":"string"},"resourceId":{"type":"string"},"resourceRevision":{"type":"string","minLength":1},"desiredRevision":{"type":"integer","minimum":0},"appliedRevision":{"type":"integer","minimum":0},"status":{"type":"string","enum":["resolving","applying","connected","degraded","revoking","revoked"]},"lastVerifiedAt":{"type":"string","nullable":true,"format":"date-time"},"lastError":{"type":"string","nullable":true}},"required":["id","deploymentId","managerId","resourceId","resourceRevision","desiredRevision","appliedRevision","status","lastVerifiedAt","lastError"]}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Registry configuration conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages":{"get":{"operationId":"listPackages","description":"List packages with optional filters. Returns packages ordered by creation date (newest first).","x-speakeasy-group":"packages","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","enum":["cli","cloudformation","gcp-sandbox-image","helm","operator-image","sandbox-bundle","terraform"],"description":"Filter by package type"},"required":false,"description":"Filter by package type","name":"type","in":"query"},{"schema":{"type":"string","enum":["pending","building","ready","failed","canceled"],"description":"Filter by package status"},"required":false,"description":"Filter by package status","name":"status","in":"query"},{"schema":{"type":"string","pattern":"^rel_[0-9a-zA-Z]{28}$","description":"Filter by source release"},"required":false,"description":"Filter by source release","name":"sourceReleaseId","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search packages by type or version"},"required":false,"description":"Search packages by type or version","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"List of packages.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Package"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}":{"get":{"operationId":"getPackage","description":"Get details of a specific package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/rebuild":{"post":{"operationId":"rebuildPackages","description":"Rebuild packages for a project. This will cancel any pending packages and create new ones with auto-incremented versions.","x-speakeasy-group":"packages","x-speakeasy-name-override":"rebuild","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"type":"string","maxLength":100,"description":"Project ID or name to rebuild packages for"}},"required":["project"]}}}},"responses":{"200":{"description":"Packages rebuilt successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"packagesCreated":{"type":"integer","description":"Number of packages created"}},"required":["packagesCreated"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle the release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/packages/{id}/cancel":{"post":{"operationId":"cancelPackage","description":"Cancel a pending or building package.","x-speakeasy-group":"packages","x-speakeasy-name-override":"cancel","parameters":[{"schema":{"type":"string","pattern":"pkg_[0-9a-z]{28}$","description":"Unique identifier for the package.","example":"pkg_jebo2o5jmm7raefl2m1pe3cz"},"required":true,"description":"Unique identifier for the package.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Package canceled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Package"}}}},"400":{"description":"Package cannot be canceled (not in pending or building status).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases":{"get":{"operationId":"listReleases","description":"Retrieve all releases.","x-speakeasy-group":"releases","x-speakeasy-name-override":"list","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"minLength":1,"maxLength":63,"pattern":"^[a-z][a-z0-9-]*$","description":"Filter to releases promoted to this channel. Defaults to production."},"required":false,"description":"Filter to releases promoted to this channel. Defaults to production.","name":"channel","in":"query"},{"schema":{"type":"string","enum":["true","false"],"default":"false"},"required":false,"name":"allChannels","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search releases by commit message, branch, SHA, or release ID"},"required":false,"description":"Search releases by commit message, branch, SHA, or release ID","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by git branch (commitRef)"},"required":false,"description":"Filter by git branch (commitRef)","name":"branch","in":"query"},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Filter by commit author login or name"},"required":false,"description":"Filter by commit author login or name","name":"author","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created after this date (ISO 8601)"},"required":false,"description":"Filter releases created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter releases created before this date (ISO 8601)"},"required":false,"description":"Filter releases created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved releases.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createRelease","description":"Create a new release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateReleaseRequest"}}}},"responses":{"201":{"description":"Release created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Release"}}}},"400":{"description":"Invalid release request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The sandbox bundle this release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/branches":{"get":{"operationId":"listReleaseBranches","description":"List distinct git branches across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listBranches","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search branches by name (case-insensitive contains)"},"required":false,"description":"Search branches by name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of branches to return"},"required":false,"description":"Maximum number of branches to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct branches.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/authors":{"get":{"operationId":"listReleaseAuthors","description":"List distinct commit authors across releases. Used for filter dropdowns.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listAuthors","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"}],"nullable":true},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search authors by login or name (case-insensitive contains)"},"required":false,"description":"Search authors by login or name (case-insensitive contains)","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":50,"description":"Maximum number of authors to return"},"required":false,"description":"Maximum number of authors to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved distinct authors.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseAuthorFilterItem"}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}":{"get":{"operationId":"getRelease","description":"Retrieve a release by ID.","x-speakeasy-group":"releases","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["project","rollout","createdBy"]},"description":"Optional fields to include: project, rollout"},"required":false,"description":"Optional fields to include: project, rollout","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseListItemResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/releases/{id}/deployments":{"get":{"operationId":"listReleaseDeployments","description":"List the project's deployments with their rollout state relative to this release.","x-speakeasy-group":"releases","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"required":true,"description":"Unique identifier for the release.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseRolloutState"},"description":"Filter deployments by rollout state"},"required":false,"description":"Filter deployments by rollout state","name":"state","in":"query"},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved release deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseDeploymentsResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels":{"get":{"operationId":"listReleaseChannels","summary":"List release channels","description":"List the release channels configured for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Project release channels.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ReleaseChannel"}}},"required":["items"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createReleaseChannel","summary":"Create a release channel","description":"Create a release channel for a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/ReleaseChannelName"},"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["name"],"additionalProperties":false}}}},"responses":{"201":{"description":"Channel created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"400":{"description":"Invalid release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}/promote":{"post":{"operationId":"promoteRelease","x-speakeasy-group":"releases","x-speakeasy-name-override":"promote","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"releaseId":{"type":"string","pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"},"expectedReleaseId":{"type":"string","nullable":true,"pattern":"rel_[0-9a-zA-Z]{28}$","description":"Unique identifier for the release.","example":"rel_WbhQgksrawSKIpEN0NAssHX9"}},"required":["releaseId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Release promoted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ReleaseChannel"}}}},"404":{"description":"Project, channel, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel changed concurrently, or the sandbox bundle its release names is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/release-channels/{name}":{"delete":{"operationId":"deleteReleaseChannel","summary":"Delete a release channel","description":"Delete a release channel from a project.","x-speakeasy-group":"releaseChannels","x-speakeasy-name-override":"delete","parameters":[{"schema":{"$ref":"#/components/schemas/ReleaseChannelName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"204":{"description":"Channel deleted."},"400":{"description":"Reserved channel.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Channel is still followed by deployments.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments":{"get":{"operationId":"listDeployments","description":"Retrieve all deployments.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"list","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Filter by exact deployment name. Must be used with deploymentGroup."},"required":false,"description":"Filter by exact deployment name. Must be used with deploymentGroup.","name":"name","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name, public subdomain, or deployment group name"},"required":false,"description":"Search deployments by name, public subdomain, or deployment group name","name":"search","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved deployments.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/DeploymentListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid deployment list filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDeployment","description":"Create a new deployment. Deployment group tokens automatically use their group. Workspace/project tokens must provide deploymentGroupId.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewDeploymentRequest"}}}},"responses":{"200":{"description":"Existing deployment returned for idempotent deployment-group registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"201":{"description":"Deployment created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentResponse"}}}},"400":{"description":"Bad request - deployment group has reached max deployments limit.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden - insufficient permissions to create deployments in this context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or deployment group not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/stats":{"get":{"operationId":"getDeploymentStats","description":"Get aggregated deployment statistics. Returns total count and breakdown by status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getStats","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter by deployment group ID or name"},"required":false,"description":"Filter by deployment group ID or name","name":"deploymentGroup","in":"query"},{"schema":{"type":"string","description":"Filter by manager ID"},"required":false,"description":"Filter by manager ID","name":"managerId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DeploymentPurpose"},{"description":"Filter by deployment purpose"}]},"required":false,"description":"Filter by deployment purpose","name":"purpose","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"description":"Filter deployments by effective environment"},"required":false,"description":"Filter deployments by effective environment","name":"environment","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["pending","preflights-failed","initial-setup","initial-setup-failed","provisioning","waiting-for-machines","waiting-for-secrets","provisioning-failed","running","refresh-failed","update-pending","updating","update-failed","delete-pending","deleting","delete-failed","teardown-required","teardown-failed","deleted","error"],"description":"Deployment status in the deployment lifecycle.\n\nFor observe-only deployments with no release or stack state, `Running`\nmeans the Operator is attached. Connectivity comes from `lastHeartbeatAt`;\nresource health comes from inventory and resource heartbeat data."},"description":"Filter deployments by status"},"required":false,"description":"Filter deployments by status","name":"status","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search deployments by name or deployment group name"},"required":false,"description":"Search deployments by name or deployment group name","name":"search","in":"query"}],"responses":{"200":{"description":"Deployment statistics retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentStats"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-environments":{"get":{"operationId":"listDeploymentFilterEnvironments","description":"List distinct effective environments used by deployments. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterEnvironments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Distinct environments retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/filter-deployment-groups":{"get":{"operationId":"listDeploymentFilterDeploymentGroups","description":"List deployment groups with deployment counts. Used for filter dropdowns.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listFilterDeploymentGroups","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","nullable":true,"maxLength":256,"description":"Search deployment groups by name"},"required":false,"description":"Search deployment groups by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return"},"required":false,"description":"Maximum number of items to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Deployment groups for filter retrieved.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"dg_[0-9a-z]{28}$","description":"Unique identifier for the deployment group.","example":"dg_r27ict8c7vcgsumpj90ackf7b"},"name":{"type":"string"},"deploymentCount":{"type":"number"},"runningCount":{"type":"number","description":"Number of deployments in 'running' status"},"failedCount":{"type":"number","description":"Number of deployments in a failed status"},"inProgressCount":{"type":"number","description":"Number of deployments in an in-progress status (provisioning, updating, etc.)"}},"required":["id","name","deploymentCount","runningCount","failedCount","inProgressCount"]}}},"required":["items"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}":{"get":{"operationId":"getDeployment","description":"Retrieve a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["release","deploymentGroup","project"]},"description":"Optional fields to include: release, deploymentGroup, project"},"required":false,"description":"Optional fields to include: release, deploymentGroup, project","name":"include","in":"query"}],"responses":{"200":{"description":"Retrieved deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentDetailResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/update-operations/{operationId}":{"get":{"operationId":"getDeploymentUpdateOperation","description":"Retrieve a deployment update operation by its durable operation ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getUpdateOperation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"duop_[0-9a-z]{28}$","description":"Unique identifier for the deployment update operation.","example":"duop_0vtxpb1sw4sbcdwg2xo37q6"},"required":true,"description":"Unique identifier for the deployment update operation.","name":"operationId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved deployment update operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}}}},"403":{"description":"The credential cannot read this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or update operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/info":{"get":{"operationId":"getDeploymentConnectionInfo","description":"Get deployment connection information including command endpoint and resource URLs.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment connection information.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentConnectionInfo"}}}},"400":{"description":"Deployment not ready (no manager assigned).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/import":{"post":{"operationId":"importDeployment","description":"Import a deployment from resolved setup infrastructure such as CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"import","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ImportDeploymentRequest"}}}},"responses":{"200":{"description":"Deployment import was idempotent and returned an existing deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"201":{"description":"Deployment imported and created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"409":{"description":"Deployment with the specified ID already exists, or a deployment with the same name already exists in the deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/first-party-inputs":{"put":{"operationId":"setFirstPartyDeploymentInputs","description":"Store operator-provided input values on a first-party deployment session token so CLI/local deploys apply them.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setFirstPartyDeploymentInputs","requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Input values stored on the session token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetFirstPartyDeploymentInputsResponse"}}}},"400":{"description":"A deployment-group token scope is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The token is not a first-party deployment session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"The requested release channel does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to store input values.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations":{"post":{"operationId":"createSetupRegistrationOperation","description":"Start a durable setup registration operation for CloudFormation, Terraform, or Helm.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createSetupRegistrationOperation","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateSetupRegistrationOperationRequest"}}}},"responses":{"202":{"description":"Setup registration operation accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"400":{"description":"Invalid setup registration operation request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The credential cannot manage this setup registration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed before callback acceptance.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/setup-registration-operations/{id}":{"get":{"operationId":"getSetupRegistrationOperation","description":"Get setup registration operation status.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getSetupRegistrationOperation","parameters":[{"schema":{"type":"string","pattern":"setupop_[0-9a-z]{28}$","description":"Unique identifier for the setup registration operation.","example":"setupop_y41lqnfosxuwqkzmiax7"},"required":true,"description":"Unique identifier for the setup registration operation.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Setup registration operation.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetupRegistrationOperationResponse"}}}},"403":{"description":"The credential cannot read this setup registration result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Setup registration operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/delete":{"post":{"operationId":"deleteDeployment","description":"Delete, detach, or forget a deployment by ID.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentRequest"}}}},"responses":{"202":{"description":"Deployment deletion request accepted.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteDeploymentResponse"}}}},"400":{"description":"Cannot delete the deployment in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/redeploy":{"post":{"operationId":"redeployDeployment","description":"Redeploy a running deployment with the same release and fresh environment variables. Sets status to update-pending.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"redeploy","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment redeployment triggered successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["message","operation"]}}}},"400":{"description":"Cannot redeploy - deployment must be running.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/pin-release":{"post":{"operationId":"pinDeploymentRelease","description":"Pin or unpin a running or runtime-failed deployment. Running deployments start an update; failed deployments retry toward the selected release.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"pinRelease","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PinReleaseRequest"}}}},"responses":{"202":{"description":"Release pin updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot pin release from the deployment's current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/release-channel":{"post":{"operationId":"setDeploymentReleaseChannel","x-speakeasy-group":"deployments","x-speakeasy-name-override":"setReleaseChannel","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"channel":{"$ref":"#/components/schemas/ReleaseChannelName"}},"required":["channel"],"additionalProperties":false}}}},"responses":{"200":{"description":"Deployment release channel updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Deployment"}}}},"400":{"description":"Channel release is unavailable for the deployment platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release channel not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/retry":{"post":{"operationId":"retryDeployment","description":"Retry a failed deployment operation. Uses alien-infra's retry mechanisms to resume from exact failure point.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"retry","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deployment retry enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Deployment is not in a failed state that can be retried.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment retry conflicts with current execution state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/inputs":{"get":{"operationId":"getDeploymentInputs","description":"Get the active input definitions and current non-secret values for a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"getInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Deployment inputs returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInputsResponse"}}}},"403":{"description":"Insufficient permission to read deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateDeploymentInputs","description":"Update runtime stack inputs, rebuild their environment-variable mappings, and request a deployment update when runtime configuration changes.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateInputs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsRequest"}}}},"responses":{"200":{"description":"Deployment inputs saved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentInputsResponse"}}}},"400":{"description":"Input values are invalid for the deployment release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update deployment inputs.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, project, or release not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/compute":{"patch":{"operationId":"updateDeploymentCompute","description":"Update deployment-time compute pool selections and request reconciliation by the hosted manager.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateCompute","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentComputeRequest"}}}},"responses":{"200":{"description":"Compute settings saved or already current.","content":{"application/json":{"schema":{"type":"object","properties":{"outcome":{"type":"string","enum":["accepted","unchanged"]},"operation":{"$ref":"#/components/schemas/DeploymentUpdateOperationSummary"}},"required":["outcome","operation"]}}}},"400":{"description":"Compute settings cannot be changed from the current lifecycle state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update compute settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/environment-variables":{"patch":{"operationId":"updateDeploymentEnvironmentVariables","description":"Replace a deployment's advanced environment variables. Stack-input-backed variables are write-only through the input endpoint. If the deployment is running and not locked, the status will be changed to update-pending to trigger a deployment.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"updateEnvironmentVariables","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDeploymentEnvironmentVariablesRequest"}}}},"responses":{"202":{"description":"Environment variables updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Environment variables are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permission to update environment variables.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/token":{"post":{"operationId":"createDeploymentToken","description":"Create a deployment token (deployment-scoped API key). The deployment must exist before creating a token.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"createToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenRequest"}}}},"responses":{"201":{"description":"Deployment token created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDeploymentTokenResponse"}}}},"403":{"description":"Forbidden - insufficient permissions to issue a deployment token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}":{"put":{"operationId":"putDynamicContainer","description":"Create or replace a dynamic container in an existing deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"put","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string"},"required":false,"name":"if-match","in":"header"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PutDynamicContainerRequest"}}}},"responses":{"202":{"description":"Desired state saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Generation conflict.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"501":{"description":"This deployment does not support dynamic containers.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDynamicContainer","description":"Get one dynamic container's desired generation, status, and internal address.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic container.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDynamicContainer","description":"Remove a dynamic container from this deployment.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"name":{"$ref":"#/components/schemas/DynamicContainerName"},"deleted":{"type":"boolean","enum":[true]}},"required":["name","deleted"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers":{"get":{"operationId":"listDynamicContainers","description":"List containers created after this deployment was installed.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Dynamic containers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/DynamicContainerResponse"}}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/dynamic-containers/{name}/logs":{"get":{"operationId":"getDynamicContainerLogs","description":"Read recent logs for one dynamic container.","x-speakeasy-group":"dynamicContainers","x-speakeasy-name-override":"logs","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"$ref":"#/components/schemas/DynamicContainerName"},"required":true,"name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":10080,"default":60},"required":false,"name":"sinceMinutes","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":200,"default":100},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"}],"responses":{"200":{"description":"Container logs.","content":{"application/json":{"schema":{"type":"object","properties":{"logs":{"type":"array","items":{"type":"object","properties":{"timestamp":{"type":"string","format":"date-time"},"level":{"type":"string"},"message":{"type":"string"},"replicaId":{"type":"string","nullable":true}},"required":["timestamp","level","message","replicaId"]}},"numHits":{"type":"number"},"nextCursor":{"type":"string","nullable":true},"partial":{"type":"boolean"},"errorCount":{"type":"number"}},"required":["logs","numHits","nextCursor","partial","errorCount"]}}}},"400":{"description":"Invalid cursor or time range.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or container not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Logs are unavailable for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/machines":{"get":{"operationId":"listDeploymentMachines","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listMachines","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines in every Horizon-backed ComputeCluster for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListDeploymentMachinesResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Horizon inventory could not be read.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation":{"get":{"operationId":"getDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Current non-secret rotation state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationStatus"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"prepareDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"expectedRevision":{"type":"integer","minimum":0,"maximum":2147483644}},"required":["expectedRevision"],"additionalProperties":false}}}},"responses":{"200":{"description":"Prepared or replayed rotation; download values explicitly","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/cancel":{"post":{"operationId":"cancelDeploymentCredentialRotation","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Cancelled; apply the newer rollback values to restore the old credential","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotation"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/credential-rotation/values":{"post":{"operationId":"getDeploymentCredentialRotationValues","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"rotationId":{"type":"string"}},"required":["rotationId"],"additionalProperties":false}}}},"responses":{"200":{"description":"Secret values for this exact current rotation. Never persist in browser storage.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentCredentialRotationValues"}}}},"403":{"description":"Rotation is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Installation not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Rotation state changed or installation is unsupported","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/volume-restores":{"post":{"operationId":"createDeploymentVolumeRestore","description":"Replace one replica's persistent volume with a new volume made from a snapshot. The deployment must be running (an update may already be queued or in progress). The replica is stopped while its volume is swapped, and the replaced volume is snapshotted before it is deleted.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"restoreVolume","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateVolumeRestoreRequest"}}}},"responses":{"202":{"description":"Volume restore requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VolumeRestore"}}}},"400":{"description":"The deployment is not running, or the resource has no persistent volume for this replica.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A restore of this volume is already pending.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listDeploymentVolumeRestores","description":"List a deployment's volume restore requests, newest first.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"listVolumeRestores","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Volume restore requests.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListVolumeRestoresResponse"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployments/{id}/volume-restores/{requestId}":{"delete":{"operationId":"cancelDeploymentVolumeRestore","description":"Cancel a pending volume restore. Use it when a restore keeps failing: the deployment stops attempting it. A restore whose volume was already swapped still finishes. Allowed in any deployment status, including update-failed.","x-speakeasy-group":"deployments","x-speakeasy-name-override":"cancelVolumeRestore","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","pattern":"vrst_[0-9a-z]{28}$","description":"Unique identifier for the volume restore.","example":"vrst_rs1j4dytswpy7wbc819jdcx"},"required":true,"description":"Unique identifier for the volume restore.","name":"requestId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Volume restore cancelled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VolumeRestore"}}}},"400":{"description":"The deployment has no deployed release.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or volume restore not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The volume restore already completed or was cancelled.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers":{"post":{"operationId":"createManager","description":"Create a new manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/NewManagerRequest"}}}},"responses":{"201":{"description":"Manager created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Invalid private manager setup method.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A manager for this target already exists.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listManagers","description":"Retrieve all managers.","x-speakeasy-group":"managers","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search managers by name"},"required":false,"description":"Search managers by name","name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"description":"Maximum number of managers to return"},"required":false,"description":"Maximum number of managers to return","name":"limit","in":"query"}],"responses":{"200":{"description":"Retrieved managers.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/Manager"}}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/setup-token":{"post":{"operationId":"retryManagerSetup","description":"Revoke previous private-manager setup tokens and issue a fresh setup token/config.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retrySetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"201":{"description":"Fresh manager setup token generated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateManagerResponse"}}}},"400":{"description":"Manager setup cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or setup config not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/retry":{"post":{"operationId":"retryManager","description":"Retry private-manager setup. Returns a fresh setup action before the internal deployment exists, or requests retry for the internal deployment after it exists.","x-speakeasy-group":"managers","x-speakeasy-name-override":"retry","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager retry handled successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerRetryResponse"}}}},"400":{"description":"Manager cannot be retried in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or internal deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/cancel-setup":{"post":{"operationId":"cancelManagerSetup","description":"Cancel pending private-manager setup, revoke setup/runtime tokens, and remove the undeployed manager record.","x-speakeasy-group":"managers","x-speakeasy-name-override":"cancelSetup","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager setup canceled successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Manager setup cannot be canceled in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}":{"get":{"operationId":"getManager","description":"Retrieve a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"get","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Manager"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteManager","description":"Delete a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"delete","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager deletion enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot delete the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Internal deployment already has a conflicting delete request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/domain-binding":{"get":{"operationId":"getManagerDomainBinding","description":"Get the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved manager domain binding.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateManagerDomainBinding","description":"Create, update, or remove the custom domain binding for a private manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"updateDomainBinding","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerDomainBinding"}}}},"responses":{"200":{"description":"Manager domain binding updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDomainBindingResponse"}}}},"400":{"description":"Invalid domain binding request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager or domain not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/management-config":{"get":{"operationId":"getManagerManagementConfig","description":"Get the management configuration for a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"getManagementConfig","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":true,"description":"Represents the target cloud platform.","name":"platform","in":"query"}],"responses":{"200":{"description":"Management config retrieved successfully.","content":{"application/json":{"schema":{"oneOf":[{"allOf":[{"type":"object","properties":{"managingRoleArn":{"type":"string","description":"The managing AWS IAM role ARN that can assume cross-account roles"}},"required":["managingRoleArn"],"description":"AWS management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["aws"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"serviceAccountEmail":{"type":"string","description":"Service account email for management roles"}},"required":["serviceAccountEmail"],"description":"GCP management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["gcp"]}},"required":["platform"]}]},{"allOf":[{"type":"object","properties":{"managingTenantId":{"type":"string","description":"The managing Azure Tenant ID for cross-tenant access"},"oidcIssuer":{"type":"string","description":"OIDC issuer URL trusted by the target-side managed identity."},"oidcSubject":{"type":"string","description":"OIDC subject claim trusted by the target-side managed identity."}},"required":["managingTenantId","oidcIssuer","oidcSubject"],"description":"Azure management configuration extracted from stack settings"},{"type":"object","properties":{"platform":{"type":"string","enum":["azure"]}},"required":["platform"]}]},{"type":"object","properties":{"platform":{"type":"string","enum":["kubernetes"]}},"required":["platform"]}],"description":"Management configuration for different cloud platforms.\n\nPlatform-derived configuration for cross-account/cross-tenant access.\nThis is NOT user-specified - it's derived from the Manager's ServiceAccount."}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/provision":{"post":{"operationId":"provisionManager","description":"Enqueue provisioning for a manager by ID.","x-speakeasy-group":"managers","x-speakeasy-name-override":"provision","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"202":{"description":"Manager provisioning enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot provision the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/update":{"post":{"operationId":"updateManager","description":"Update a manager to a specific release ID or active release.","x-speakeasy-group":"managers","x-speakeasy-name-override":"update","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateManagerRequest"}}}},"responses":{"202":{"description":"Manager update enqueued successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}},"400":{"description":"Cannot update the manager in its current state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/events":{"get":{"operationId":"listManagerEvents","description":"Retrieve all events of a manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"listEvents","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Event"}}},"required":["items"]}}}},"400":{"description":"Manager does not expose user-accessible events.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/token":{"post":{"operationId":"generateManagerToken","description":"Generate a short-lived JWT for direct browser → manager communication. Used for fetching command payloads and querying logs without routing sensitive data through the platform API.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenRequest"}}}},"responses":{"200":{"description":"Manager access token and connection info.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerTokenResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/binding-token":{"post":{"operationId":"generateManagerBindingToken","description":"Generate a short-lived deployment-scoped token for resolving opted-in remote bindings through the currently assigned manager.","x-speakeasy-group":"managers","x-speakeasy-name-override":"generateManagerBindingToken","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenRequest"}}}},"responses":{"200":{"description":"Remote Bindings token and assigned manager URL.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GenerateManagerBindingTokenResponse"}}}},"403":{"description":"The caller cannot access Remote Bindings for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Assigned manager or deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A sandbox token was requested but the deployment's current release publishes no remote sandbox, or more than one.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed, such as an unknown binding kind.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/gcp-oauth-provider/resolve":{"post":{"operationId":"resolveManagerGcpOAuthProvider","description":"Resolve decrypted project-level Google Cloud OAuth provider settings for a manager-side deployment bootstrap.","x-speakeasy-group":"managers","x-speakeasy-name-override":"resolveGcpOAuthProvider","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderRequest"}}}},"responses":{"200":{"description":"Resolved Google Cloud OAuth provider settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveManagerGcpOAuthProviderResponse"}}}},"401":{"description":"Unauthorized.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Manager cannot resolve this deployment group's project settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Manager, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/heartbeat":{"post":{"operationId":"reportManagerHeartbeat","description":"Report Manager health status and metrics.","x-speakeasy-group":"managers","x-speakeasy-name-override":"reportHeartbeat","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatRequest"}}}},"responses":{"200":{"description":"Heartbeat acknowledged.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerHeartbeatResponse"}}}},"404":{"description":"Manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/deployment":{"get":{"operationId":"getManagerDeployment","description":"Get deployment details for a private manager (internal deployment platform, status, resources).","x-speakeasy-group":"managers","x-speakeasy-name-override":"getDeployment","parameters":[{"schema":{"allOf":[{"$ref":"#/components/schemas/ManagerID"},{"description":"Unique identifier for a manager."}]},"required":true,"description":"Unique identifier for a manager.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Manager deployment details.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ManagerDeployment"}}}},"404":{"description":"Manager not found or has no internal deployment (alien-hosted managers don't have deployment info).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Operation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/snapshot":{"get":{"operationId":"getContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"responses":{"200":{"description":"Complete desired registry snapshot assigned to this Manager","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContainerRegistryManagerSnapshot"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/managers/{id}/container-registry/applied":{"post":{"operationId":"applyContainerRegistryManagerSnapshot","tags":["container-registry"],"parameters":[{"schema":{"type":"string","minLength":1},"required":true,"name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"routeId":{"type":"string","pattern":"crroute_[0-9a-z]{28}$","description":"Unique identifier for the container registry route.","example":"crroute_c9t4xoy7fmiq7equtu20"},"desiredRevision":{"type":"integer","minimum":0},"repositories":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"crrepo_[0-9a-z]{28}$","description":"Unique identifier for the container registry repository.","example":"crrepo_625temdq3bnu25jw9rcux"},"status":{"type":"string","enum":["ready","deleted","failed"]},"routableUpstreamName":{"type":"string","nullable":true,"minLength":1},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["id","status","routableUpstreamName","error"],"additionalProperties":false}},"verification":{"type":"object","nullable":true,"properties":{"succeeded":{"type":"boolean"},"observedAt":{"type":"string","format":"date-time"},"error":{"type":"string","nullable":true,"maxLength":2000}},"required":["succeeded","observedAt","error"],"additionalProperties":false}},"required":["routeId","desiredRevision","repositories","verification"],"additionalProperties":false}}}},"responses":{"200":{"description":"Applied registry snapshot revision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApplyContainerRegistrySnapshotResponse"}}}},"403":{"description":"Manager access denied","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Snapshot revision conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/prepare":{"post":{"operationId":"prepareOperatorManifestPackage","tags":["operator-manifests"],"summary":"Prepare the white-labeled Operator image for an Operate install","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageRequest"}}}},"responses":{"200":{"description":"Operator image package created or reused.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PrepareOperatorManifestPackageResponse"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/render":{"post":{"operationId":"renderOperatorManifest","tags":["operator-manifests"],"summary":"Render a Kubernetes Operator manifest","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestRequest"}}}},"responses":{"200":{"description":"Operator manifest rendered successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorManifestResponse"}}}},"400":{"description":"An enabled custom plugin has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Operator image package is not ready.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid platform or manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/bootstrap-write-check":{"post":{"operationId":"checkEcsBootstrapWrite","tags":["operator-manifests"],"description":"Checks a Remote Operator setup token and its exact AWS target before the local bootstrap command writes a registration secret. A registered stack cannot use this path.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/EcsBootstrapWriteCheckRequest"}}}},"responses":{"204":{"description":"The setup token may write the bootstrap secret."},"400":{"description":"The AWS target is invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"The setup token is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The setup token cannot read this deployment group.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The setup token does not match the target or the stack has registered.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operator-manifests/ecs-cloudformation/render":{"post":{"operationId":"renderOperatorEcsCloudFormation","tags":["operator-manifests"],"summary":"Render a Remote Operator ECS Fargate CloudFormation installer","description":"Renders a credential-free CloudFormation artifact that reuses a customer-owned ECS cluster and network; creates retained EFS identity storage unless an existing filesystem and access point are supplied; owns a task role compiled from the project's enabled operations; and uses a generated local command to hand one-time setup material directly to same-account, same-Region Secrets Manager. Sensitive S3 and SQS wildcard declarations fail closed unless the request supplies exact resource ceilings.","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationRequest"}}}},"responses":{"200":{"description":"CloudFormation installer rendered, or null template and deployCommand while imagePending is true.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RenderOperatorEcsCloudFormationResponse"}}}},"400":{"description":"Enabled AWS permissions cannot be safely compiled or directly deployed with the supplied resource ceilings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not authorized to update the project or use the selected Operator image package.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Operator image package not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The selected Operator image package is unavailable, or the registered stack belongs to a different ECS cluster.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Request body validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Invalid Operator image or AWS manager configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys":{"get":{"operationId":"listAPIKeys","description":"Retrieve all API keys for the current workspace.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved API keys.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/APIKey"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAPIKey","description":"Create a new API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyRequest"}}}},"responses":{"201":{"description":"API key created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAPIKeyResponse"}}}},"403":{"description":"Insufficient permissions to create API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/{id}":{"get":{"operationId":"getAPIKey","description":"Retrieve a specific API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"patch":{"operationId":"updateAPIKey","description":"Update an API key (enable/disable, change description).","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateAPIKeyRequest"}}}},"responses":{"200":{"description":"API key updated successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIKey"}}}},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"revokeAPIKey","description":"Revoke (soft delete) an API key.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"revoke","parameters":[{"schema":{"type":"string","pattern":"apikey_[0-9a-z]{28}$","description":"Unique identifier for the api key.","example":"apikey_ye96yxs1tjnrrwulp8frh"},"required":true,"description":"Unique identifier for the api key.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"API key revoked successfully."},"404":{"description":"API key not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/api-keys/batch-delete":{"post":{"operationId":"deleteAPIKeys","description":"Permanently delete multiple API keys.","x-speakeasy-group":"apiKeys","x-speakeasy-name-override":"deleteMultiple","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeleteAPIKeysRequest"}}}},"responses":{"200":{"description":"API keys deleted successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"deletedCount":{"type":"number"}},"required":["deletedCount"]}}}},"403":{"description":"Insufficient permissions to delete API keys.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains":{"get":{"operationId":"listDomains","description":"List system domains and workspace domains.","x-speakeasy-group":"domains","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domains.","content":{"application/json":{"schema":{"type":"object","properties":{"domains":{"type":"array","items":{"$ref":"#/components/schemas/DomainWithUsage"}}},"required":["domains"]}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDomain","description":"Create a workspace domain and optional initial endpoints.","x-speakeasy-group":"domains","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253},"setup":{"type":"object","properties":{"deploymentPortal":{"type":"boolean"},"packages":{"type":"boolean"},"deploymentUrlProjectId":{"type":"string","nullable":true,"pattern":"prj_[0-9a-z]{28}$","description":"Unique identifier for the project.","example":"prj_mcytp6z3j91f7tn5ryqsfwtr"},"managerIds":{"type":"array","items":{"type":"string"}}}}},"required":["domain"]}}}},"responses":{"200":{"description":"Returned an existing workspace domain claim.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"201":{"description":"Created domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Domain is reserved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Insufficient permissions or plan limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/endpoints":{"post":{"operationId":"createDomainEndpoint","description":"Create an endpoint under a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"createEndpoint","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["deployment_portal","workspace_packages","manager_api","deployment_url_base"]},"owner":{"type":"object","properties":{"type":{"type":"string","enum":["workspace","project","manager"]},"id":{"type":"string"}},"required":["type","id"]}},"required":["kind"]}}}},"responses":{"201":{"description":"Created endpoint.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"400":{"description":"Bad request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Endpoint cleanup is still in progress.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}":{"get":{"operationId":"getDomain","description":"Get domain by ID.","x-speakeasy-group":"domains","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved domain.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"delete":{"operationId":"deleteDomain","description":"Delete a workspace domain.","x-speakeasy-group":"domains","x-speakeasy-name-override":"delete","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain deletion requested.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean"}},"required":["success"]}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Domain is in use.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/domains/{id}/refresh":{"post":{"operationId":"refreshDomain","description":"Refresh workspace domain verification.","x-speakeasy-group":"domains","x-speakeasy-name-override":"refresh","parameters":[{"schema":{"type":"string","pattern":"dom_[0-9a-z]{28}$","description":"Unique identifier for the domain.","example":"dom_469m0agk8luj4s16sakmmpdd"},"required":true,"description":"Unique identifier for the domain.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Domain verification refresh requested.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DomainWithUsage"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events":{"get":{"operationId":"listEvents","description":"Retrieve all events.","x-speakeasy-group":"events","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","description":"Filter events to a single deployment."},"required":false,"description":"Filter events to a single deployment.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Filter events to a single release."},"required":false,"description":"Filter events to a single release.","name":"releaseId","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["releaseCreatedAt"]},"description":"Optional fields to include: releaseCreatedAt"},"required":false,"description":"Optional fields to include: releaseCreatedAt","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved events.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/EventListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/events/{id}":{"get":{"operationId":"getEvent","description":"Retrieve an event by ID.","x-speakeasy-group":"events","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"event_[0-9a-zA-Z]{28}$","description":"Unique identifier for the event.","example":"event_MtSA24M3pWuAkQYxgZxuRI"},"required":true,"description":"Unique identifier for the event.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved event.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Event"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents":{"get":{"operationId":"listIncidents","description":"List authorized incidents without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string"},"required":false,"name":"projectId","in":"query"},{"schema":{"type":"string","enum":["queued","running","halted","complete","error","canceled"]},"required":false,"name":"status","in":"query"},{"schema":{"type":"string","maxLength":256},"required":false,"name":"search","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":25},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","maxLength":4096},"required":false,"name":"cursor","in":"query"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incidents.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentListResponse"}}}},"400":{"description":"Invalid request or cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/incidents/{id}":{"get":{"operationId":"getIncident","description":"Get an authorized incident without Slack transport metadata.","x-speakeasy-group":"incidents","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":1,"maxLength":128},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Incident.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncidentResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Incident not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens":{"get":{"operationId":"listMachinesJoinTokens","x-speakeasy-group":"machines","x-speakeasy-name-override":"listJoinTokens","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Join tokens for a Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListMachinesJoinTokensResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"createJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Newly minted Machines join token. Existing tokens keep working; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/rotate":{"post":{"operationId":"rotateMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"rotateJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Rotated Machines join token. Revokes all existing tokens, then mints a new one; the token value is returned only once.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RotateMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/join-tokens/{tokenId}":{"delete":{"operationId":"revokeMachinesJoinToken","x-speakeasy-group":"machines","x-speakeasy-name-override":"revokeJoinToken","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"tokenId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines join token revocation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeMachinesJoinTokenResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}/drain":{"delete":{"operationId":"cancelMachinesMachineDrain","x-speakeasy-group":"machines","x-speakeasy-name-override":"cancelMachineDrain","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines drain cancellation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CancelMachinesMachineDrainResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"drainMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"drainMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineRequest"}}}},"responses":{"200":{"description":"Machines drain request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DrainMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/machines/deployments/{id}/machines/{machineId}":{"delete":{"operationId":"removeMachinesMachine","x-speakeasy-group":"machines","x-speakeasy-name-override":"removeMachine","parameters":[{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Unique identifier for the deployment.","name":"id","in":"path"},{"schema":{"type":"string","minLength":1},"required":true,"name":"machineId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Machines remove request result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RemoveMachinesMachineResponse"}}}},"400":{"description":"Deployment is not a provisioned Machines deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/bootstrap":{"post":{"operationId":"bootstrapCommands","description":"Resolve a deployment's current manager and mint a five-minute command capability. Sender tokens can dispatch and observe commands only for this deployment. Receiver tokens can lease and complete commands only for the resolved Container or Daemon target.","x-speakeasy-group":"commands","x-speakeasy-name-override":"bootstrap","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapRequest"}}}},"responses":{"200":{"description":"Manager connection details and a short-lived command capability.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommandBootstrapResponse"}}}},"400":{"description":"Invalid request or deployment state.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Authentication required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The caller cannot operate this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, manager, or receiver target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"The selected resource cannot run an external receiver.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The assigned manager is offline.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands":{"get":{"operationId":"listCommands","description":"Retrieve commands. Use for dashboard analytics and command history.","x-speakeasy-group":"commands","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"type":"string","enum":["PENDING_UPLOAD","PENDING","DISPATCHED","SUCCEEDED","FAILED","EXPIRED"],"description":"Filter by command state"},"required":false,"description":"Filter by command state","name":"state","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Filter by command name"},"required":false,"description":"Filter by command name","name":"name","in":"query"},{"schema":{"type":"string","maxLength":256,"description":"Search commands by name"},"required":false,"description":"Search commands by name","name":"search","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created after this date (ISO 8601)"},"required":false,"description":"Filter commands created after this date (ISO 8601)","name":"createdAfter","in":"query"},{"schema":{"type":"string","nullable":true,"format":"date-time","description":"Filter commands created before this date (ISO 8601)"},"required":false,"description":"Filter commands created before this date (ISO 8601)","name":"createdBefore","in":"query"},{"schema":{"type":"array","items":{"type":"string","enum":["deployment","project"]},"description":"Optional fields to include: deployment, project"},"required":false,"description":"Optional fields to include: deployment, project","name":"include","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Retrieved commands.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/CommandListItemResponse"},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createCommand","description":"Create command metadata. Called by manager when processing commands. Returns project info for routing decisions.","x-speakeasy-group":"commands","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandRequest"}}}},"responses":{"201":{"description":"Command created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateCommandResponse"}}}},"400":{"description":"Deployment is not ready or has no assigned manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The operation access request is no longer approved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The deployment manager is unavailable.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/names":{"get":{"operationId":"listCommandNames","description":"List distinct command names. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listNames","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search command names (prefix match)"},"required":false,"description":"Search command names (prefix match)","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct command names.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandNamesResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/deployments":{"get":{"operationId":"listCommandDeployments","description":"List distinct deployments that have commands, including deployment group info. Use for filter dropdowns in the dashboard.","x-speakeasy-group":"commands","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","maxLength":255,"description":"Search deployment or deployment group names"},"required":false,"description":"Search deployment or deployment group names","name":"search","in":"query"}],"responses":{"200":{"description":"Distinct deployments that have commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListCommandDeploymentsResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/target":{"get":{"operationId":"resolveCommandTarget","description":"Resolve which resource a command for this deployment would be addressed to, and how it would be delivered. Fails when the deployment has no command-capable resources, or more than one and no explicit target was named.","x-speakeasy-group":"commands","x-speakeasy-name-override":"resolveTarget","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Deployment to resolve the target for","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"Deployment to resolve the target for","name":"deploymentId","in":"query"},{"schema":{"type":"string","maxLength":255,"description":"Explicit resource id to resolve; must be a command-capable resource"},"required":false,"description":"Explicit resource id to resolve; must be a command-capable resource","name":"target","in":"query"},{"schema":{"type":"string","minLength":1,"maxLength":255,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead."},"required":false,"description":"Command name being invoked. A name that is an operation enabled for the deployment fails with COMMAND_IS_OPERATION, which gives the `alien operations invoke` command to run instead.","name":"command","in":"query"}],"responses":{"200":{"description":"Resolved command target.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolvedCommandTarget"}}}},"404":{"description":"Deployment or target not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Multiple command-capable targets; an explicit target is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Deployment has no command-capable targets, or the command is an operation enabled for the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}":{"patch":{"operationId":"updateCommand","description":"Update command state. Called by manager when command is dispatched or completes.","x-speakeasy-group":"commands","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateCommandRequest"}}}},"responses":{"200":{"description":"Command updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getCommand","description":"Retrieve a command by ID.","x-speakeasy-group":"commands","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["true"],"description":"Explicitly confirm access to an operation result marked sensitive."},"required":false,"description":"Explicitly confirm access to an operation result marked sensitive.","name":"confirmSensitiveOutput","in":"query"}],"responses":{"200":{"description":"Retrieved command.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Command"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid operation result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/dispatch":{"post":{"operationId":"dispatchCommand","description":"Atomically mark a command DISPATCHED unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"dispatch","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandRequest"}}}},"responses":{"200":{"description":"Dispatch attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DispatchCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/complete":{"post":{"operationId":"completeCommand","description":"Atomically transition a command to a terminal state (SUCCEEDED, FAILED, or EXPIRED) unless it is already terminal. Returns whether the transition was applied.","x-speakeasy-group":"commands","x-speakeasy-name-override":"complete","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandRequest"}}}},"responses":{"200":{"description":"Completion attempt result.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CompleteCommandResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/commands/{id}/increment-attempt":{"post":{"operationId":"incrementCommandAttempt","description":"Atomically increment the command's attempt counter and return the new value.","x-speakeasy-group":"commands","x-speakeasy-name-override":"incrementAttempt","parameters":[{"schema":{"type":"string","pattern":"cmd_[0-9a-zA-Z]{28}$","description":"Unique identifier for the command.","example":"cmd_2sxjXxvOYct7IohT3ukliAzf"},"required":true,"description":"Unique identifier for the command.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Attempt incremented.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/IncrementCommandAttemptResponse"}}}},"404":{"description":"Command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"The API cannot serve the request right now; retry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions":{"get":{"operationId":"listDebugSessions","description":"Retrieve debug sessions for dashboard audit. Filters: project, deployment, state, mode.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":false,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID","name":"deploymentId","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/DebugSessionState"},{"description":"Filter by session state"}]},"required":false,"description":"Filter by session state","name":"state","in":"query"},{"schema":{"type":"string","enum":["push","pull"],"description":"Filter by deployment model (push/pull). Joins against the parent deployment."},"required":false,"description":"Filter by deployment model (push/pull). Joins against the parent deployment.","name":"mode","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Filter by cloud provider. Joins against the parent deployment."},"required":false,"description":"Filter by cloud provider. Joins against the parent deployment.","name":"provider","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"Paginated debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSessionListResponse"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createDebugSession","description":"Create a debug-session audit row. Called by the manager when a pull or push debug tunnel is opened. Workspace + project derived from deployment.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"create","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateDebugSessionRequest"}}}},"responses":{"201":{"description":"Debug session created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Deployment or access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/debug-sessions/{id}":{"patch":{"operationId":"updateDebugSession","description":"Update debug-session state. Called by manager on tunnel attach, close, or deadline expiry.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"update","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateDebugSessionRequest"}}}},"responses":{"200":{"description":"Debug session updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Debug session not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"getDebugSession","description":"Retrieve a debug session by ID.","x-speakeasy-group":"debugSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","pattern":"dbg_[0-9a-zA-Z]{28}$","description":"Unique identifier for the debug session.","example":"dbg_HOXmkmT9UPYlsnxqSNlEGoXL"},"required":true,"description":"Unique identifier for the debug session.","name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Retrieved debug session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DebugSession"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info":{"get":{"operationId":"getDeploymentInfo","description":"Get deployment information for the deployment portal. Accepts both deployment-scoped and deployment-group-scoped API keys. Returns project information, package status/outputs, and either deployment or deployment group details depending on the token type. Poll this endpoint to check if packages are ready.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"getInfo","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"required":false,"description":"Represents the target cloud platform.","name":"platform","in":"query"},{"schema":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"required":false,"name":"setupItem","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"updateOperationId","in":"query"}],"responses":{"200":{"description":"Deployment information retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentInfo"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-scoped or deployment-group-scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment, deployment group, or project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/compute-plan":{"post":{"operationId":"planDeploymentCompute","description":"Plan deployment compute for the active release before stack preparation. The response contains recommended machine and scale choices for cloud compute pools.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"planCompute","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Compute plan returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentComputePlan"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/deployment-info/prepare-stack":{"post":{"operationId":"prepareDeploymentStack","description":"Prepare the active release stack for a deployment portal setup session. The response contains the generated stack shape plus setup compatibility metadata.","x-speakeasy-group":"deployment","x-speakeasy-name-override":"prepareStack","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"saveForSetup":{"type":"boolean","description":"Persist validated choices for the exact blocked update; does not apply cloud changes."},"setupItem":{"type":"string","enum":["deployment","models","keys","bucket","registry","sandbox"]},"deploymentId":{"type":"string"},"updateOperationId":{"type":"string"},"platform":{"type":"string","enum":["aws","gcp","azure"]},"setupMethod":{"$ref":"#/components/schemas/DeploymentSetupMethod"},"region":{"type":"string"},"stackSettings":{"type":"object","properties":{"compute":{"oneOf":[{"type":"object","properties":{"pools":{"type":"object","properties":{},"additionalProperties":{"oneOf":[{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"machines":{"type":"integer","minimum":0,"description":"Number of machines to run."},"mode":{"type":"string","enum":["fixed"]}},"required":["machines","mode"]},{"type":"object","properties":{"failure_domains":{"oneOf":[{"type":"object","properties":{"selectedFailureDomains":{"type":"array","items":{"type":"string"},"description":"Concrete provider domains selected during setup.\nEmpty delegates deterministic selection to the provider setup implementation."},"spread":{"type":"integer","minimum":0,"description":"Number of distinct failure domains across which new stateful replicas may be spread."}},"required":["spread"],"description":"Failure-domain policy selected for a compute pool."},{"nullable":true}]},"machine":{"type":"string","nullable":true,"description":"Provider machine type selected for this deployment."},"max":{"type":"integer","minimum":0,"description":"Maximum machine count."},"min":{"type":"integer","minimum":0,"description":"Minimum machine count."},"mode":{"type":"string","enum":["autoscale"]}},"required":["max","min","mode"]}],"description":"User-selected deployment settings for one compute pool."},"description":"Selected compute choices keyed by pool ID."}},"description":"Deployment-time compute choices for Alien-managed compute pools.\n\nApplication source declares portable pool requirements. This settings\nobject stores the concrete choices made for one deployment, such as the\nprovider machine type and selected machine counts."},{"nullable":true}]},"deploymentModel":{"type":"string","enum":["push","pull"],"description":"Deployment model: how updates are delivered to the remote environment."},"domains":{"oneOf":[{"type":"object","properties":{"customDomains":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{"certificate":{"type":"object","properties":{"aws":{"oneOf":[{"type":"object","properties":{"certificateArn":{"type":"string"}},"required":["certificateArn"]},{"nullable":true}]},"azure":{"oneOf":[{"type":"object","properties":{"keyVaultCertificateId":{"type":"string"},"keyVaultResourceId":{"type":"string","nullable":true}},"required":["keyVaultCertificateId"]},{"nullable":true}]},"gcp":{"oneOf":[{"type":"object","properties":{"certificateName":{"type":"string"}},"required":["certificateName"]},{"nullable":true}]},"kubernetes":{"oneOf":[{"type":"object","properties":{"tlsSecretRef":{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."}},"required":["tlsSecretRef"]},{"nullable":true}]}},"description":"Platform-specific certificate references for custom domains."},"domain":{"type":"string","description":"Fully qualified domain name to use."}},"required":["certificate","domain"],"description":"Custom domain configuration for a single resource."},"description":"Custom domain configuration per resource ID."},"publicEndpointTarget":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["machineAddresses"]}},"required":["mode"]},{"type":"object","properties":{"cnameTarget":{"type":"string","description":"DNS name or URL for the external load balancer."},"mode":{"type":"string","enum":["loadBalancer"]}},"required":["cnameTarget","mode"]},{"nullable":true}]}},"description":"Domain configuration for the stack.\n\nWhen `custom_domains` is set, the specified resources use customer-provided\ndomains and certificates. Otherwise, Alien auto-generates domains."},{"nullable":true}]},"endpointAccess":{"type":"string","enum":["internet","private"],"description":"Reachability of the deployment's public endpoints, fixed at setup."},"externalBindings":{"type":"object","nullable":true,"properties":{},"description":"External bindings for pre-existing infrastructure.\nAllows using existing resources (MinIO, Redis, shared Container Apps\nEnvironment, etc.) instead of having Alien provision them.\nRequired for Kubernetes platform, optional for cloud platforms."},"heartbeats":{"type":"string","enum":["off","on"],"description":"How heartbeat health checks are handled."},"kubernetes":{"oneOf":[{"type":"object","properties":{"cluster":{"oneOf":[{"type":"object","properties":{"cloud":{"oneOf":[{"type":"object","properties":{"accountId":{"type":"string","nullable":true},"clusterId":{"type":"string","nullable":true},"clusterName":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"subscriptionId":{"type":"string","nullable":true}},"description":"Optional provider-specific identity for a cloud-backed Kubernetes cluster."},{"nullable":true}]},"namespace":{"type":"string","nullable":true,"description":"Namespace where the Alien chart and application resources run."},"ownership":{"type":"string","enum":["managed","existing","external"],"description":"Ownership model for the Kubernetes cluster."}},"required":["ownership"],"description":"Kubernetes cluster setup settings."},{"nullable":true}]},"exposure":{"oneOf":[{"type":"object","properties":{"mode":{"type":"string","enum":["disabled"]}},"required":["mode"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"mode":{"type":"string","enum":["generated"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","mode","route"]},{"type":"object","properties":{"certificate":{"oneOf":[{"allOf":[{"type":"object","properties":{"namespace":{"type":"string","nullable":true,"description":"Secret namespace. Defaults to the release namespace when omitted."},"secretName":{"type":"string","description":"Secret name."}},"required":["secretName"],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["tlsSecretRef"]}},"required":["mode"]}],"description":"Namespace-scoped Kubernetes TLS Secret reference."},{"type":"object","properties":{"mode":{"type":"string","enum":["managedAcmImport"]},"region":{"type":"string","nullable":true,"description":"ACM region. Defaults to the deployment region when omitted."},"tags":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Tags applied to runtime-imported ACM certificates."}},"required":["mode"]},{"type":"object","properties":{"certificateArn":{"type":"string","description":"Existing ACM certificate ARN."},"mode":{"type":"string","enum":["awsAcmArn"]}},"required":["certificateArn","mode"]},{"type":"object","properties":{"mode":{"type":"string","enum":["managedTlsSecret"]},"secretNameTemplate":{"type":"string","description":"Secret name template. Runtime may substitute resource/deployment tokens."}},"required":["mode","secretNameTemplate"]},{"type":"object","properties":{"mode":{"type":"string","enum":["none"]}},"required":["mode"]}],"description":"Certificate publication or reference mode for Kubernetes public endpoints."},"domain":{"type":"string","description":"Hostname routed by the Kubernetes public endpoint."},"mode":{"type":"string","enum":["custom"]},"route":{"oneOf":[{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example `eks.amazonaws.com/alb`."},"ingressClassName":{"type":"string","description":"`spec.ingressClassName` for generated Ingresses."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["ingressClassName"],"description":"Shared Ingress route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["ingress"]}},"required":["routeApi"]}],"description":"Shared Ingress route profile values."},{"allOf":[{"type":"object","properties":{"annotations":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Annotations applied to route objects."},"controller":{"type":"string","nullable":true,"description":"Route controller identifier, for example a cloud Gateway controller."},"gatewayClassName":{"type":"string","description":"GatewayClass selected for generated Gateways."},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"},"description":"Labels applied to route objects."},"listenerPort":{"type":"integer","minimum":0,"description":"Listener port, usually 443."},"provider":{"oneOf":[{"type":"object","properties":{"ipAddressType":{"type":"string","nullable":true,"description":"Optional ALB IP address type, such as `dualstack`."},"provider":{"type":"string","enum":["awsAlb"]},"scheme":{"type":"string","description":"Internet-facing or internal ALB scheme."},"subnetIds":{"type":"array","items":{"type":"string"},"description":"Explicit subnet IDs when the profile cannot rely on controller discovery."},"targetType":{"type":"string","description":"ALB target type, usually `ip`."}},"required":["provider","scheme","targetType"]},{"type":"object","properties":{"provider":{"type":"string","enum":["gkeGateway"]},"staticAddressName":{"type":"string","nullable":true,"description":"Optional static address name for the Gateway frontend."}},"required":["provider"]},{"type":"object","properties":{"albName":{"type":"string","nullable":true,"description":"Optional ALB name when using BYO Application Gateway resources."},"albNamespace":{"type":"string","nullable":true,"description":"Optional ALB namespace when using BYO Application Gateway resources."},"frontend":{"type":"string","description":"Public or internal frontend exposure."},"provider":{"type":"string","enum":["azureApplicationGatewayForContainers"]}},"required":["frontend","provider"]},{"nullable":true}]}},"required":["gatewayClassName","listenerPort"],"description":"Shared Gateway API route profile values."},{"type":"object","properties":{"routeApi":{"type":"string","enum":["gateway"]}},"required":["routeApi"]}],"description":"Shared Gateway API route profile values."}],"description":"Kubernetes route API selected for public endpoints."}},"required":["certificate","domain","mode","route"]},{"nullable":true}]}},"description":"Kubernetes runtime substrate configuration.\n\nThis controls how setup chooses the cluster backing `Platform::Kubernetes`\ndeployments. When omitted, cloud-backed Kubernetes deployments default to a\nmanaged cluster and generic/on-prem Kubernetes defaults to an external\ncluster."},{"nullable":true}]},"network":{"oneOf":[{"type":"object","properties":{"type":{"type":"string","enum":["use-default"]}},"required":["type"]},{"type":"object","properties":{"availability_zones":{"type":"integer","minimum":0,"description":"Number of availability zones (default: 2)."},"cidr":{"type":"string","nullable":true,"description":"VPC/VNet CIDR block. If not specified, auto-generated from stack ID\nto reduce conflicts (e.g., \"10.{hash}.0.0/16\")."},"type":{"type":"string","enum":["create"]}},"required":["type"]},{"type":"object","properties":{"private_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of private subnets"},"public_subnet_ids":{"type":"array","items":{"type":"string"},"description":"IDs of public subnets (required for public ingress)"},"security_group_ids":{"type":"array","items":{"type":"string"},"description":"Optional security group IDs to use"},"type":{"type":"string","enum":["byo-vpc-aws"]},"vpc_id":{"type":"string","description":"The ID of the existing VPC"}},"required":["private_subnet_ids","public_subnet_ids","type","vpc_id"]},{"type":"object","properties":{"network_name":{"type":"string","description":"The name of the existing VPC network"},"region":{"type":"string","description":"The region of the subnet"},"subnet_name":{"type":"string","description":"The name of the subnet to use"},"type":{"type":"string","enum":["byo-vpc-gcp"]}},"required":["network_name","region","subnet_name","type"]},{"type":"object","properties":{"application_gateway_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated classic Application Gateway subnet within the VNet."},"private_endpoint_subnet_name":{"type":"string","nullable":true,"description":"Name of the dedicated subnet that hosts Private Endpoints (e.g. for a\nPostgres Flexible Server). A Private Endpoint must not share the private\nsubnet, which is already claimed by the Container Apps environment's\n`infrastructure_subnet_id`. Required only when the stack contains a\nPostgres resource; otherwise unused."},"private_subnet_name":{"type":"string","description":"Name of the private subnet within the VNet"},"public_subnet_name":{"type":"string","description":"Name of the public subnet within the VNet"},"type":{"type":"string","enum":["byo-vnet-azure"]},"vnet_resource_id":{"type":"string","description":"The full resource ID of the existing VNet"}},"required":["private_subnet_name","public_subnet_name","type","vnet_resource_id"]},{"nullable":true}]},"publicEndpoints":{"type":"object","nullable":true,"properties":{},"additionalProperties":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"description":"Exact externally managed endpoint URLs, keyed by resource ID and endpoint name.\n\nThis is intended for adopted Machines deployments whose DNS and certificates remain\ncustomer-owned. The platform passes these URLs to the runtime without creating or\nreplacing DNS records or certificates."},"telemetry":{"type":"string","enum":["off","auto","approval-required"],"description":"How telemetry (logs, metrics, traces) is handled."},"updates":{"type":"string","enum":["auto","approval-required"],"description":"How updates are delivered to the deployment."}},"description":"User-customizable deployment settings specified at deploy time.\n\nThese settings are provided by the customer via CloudFormation parameters,\nTerraform attributes, CLI flags, or Helm values. They customize how the\ndeployment runs and what capabilities are enabled.\n\n**Key distinction**: StackSettings is user-customizable, while ManagementConfig\nis platform-derived (from the Manager's ServiceAccount)."}},"required":["platform","setupMethod","stackSettings"]}}}},"responses":{"200":{"description":"Prepared stack returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PreparedDeploymentStack"}}}},"400":{"description":"Invalid setup update request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized — requires a deployment-group scoped API key.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Setup update is not authorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment group, project, release, or manager not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The deployment setup target changed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/install-url":{"post":{"operationId":"slackIntegrationInstallUrl","description":"Generate the Slack OAuth consent URL for this workspace.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"installUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"OAuth URL the dashboard should redirect the user to.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackInstallUrlResponse"}}}},"500":{"description":"Server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/status":{"get":{"operationId":"slackIntegrationStatus","description":"Return the Slack install for this workspace (if any).","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"status","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Status.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackIntegrationStatus"}}}}}}},"/v1/integrations/slack/channels":{"get":{"operationId":"slackIntegrationChannels","description":"List public Slack channels for this workspace's install. Used by the dashboard's notification-channel picker.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"listChannels","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Public channels.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackChannelsResponse"}}}},"400":{"description":"Workspace not connected to Slack.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/notification-channel":{"put":{"operationId":"slackIntegrationSetNotificationChannel","description":"Configure which Slack channel receives ai-agent monitor reports.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"setNotificationChannel","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelRequest"}}}},"responses":{"200":{"description":"Channel saved.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SlackNotificationChannelResponse"}}}},"400":{"description":"Not connected, or join failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/integrations/slack/installation":{"delete":{"operationId":"slackIntegrationUninstall","description":"Uninstall the Slack integration for this workspace. Revokes the bot token at Slack and deletes the row.","x-speakeasy-group":"slackIntegration","x-speakeasy-name-override":"uninstall","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"204":{"description":"Uninstalled."}}}},"/v1/agent-sessions":{"get":{"operationId":"listAgentSessions","description":"List ai-agent monitor sessions for this workspace, or for one project. Newest first, capped at 50.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"allOf":[{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},{"description":"Only sessions bound to this project. Omit to list the whole workspace."}]},"required":false,"description":"Only sessions bound to this project. Omit to list the whole workspace.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionListResponse"}}}}}}},"/v1/agent-sessions/{id}":{"get":{"operationId":"getAgentSession","description":"Retrieve one ai-agent monitor session by id.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Session.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionDetail"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/events":{"get":{"operationId":"listAgentSessionEvents","description":"Incrementally read a session's event log (steps, tool calls, report deltas, approvals, status transitions). Pass the previous response's `latestSeq` as `after` to fetch only new events.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"events","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"integer","nullable":true,"minimum":0,"default":0},"required":false,"name":"after","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":500,"default":200},"required":false,"name":"limit","in":"query"}],"responses":{"200":{"description":"Events after the cursor, oldest first.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionEventsResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Forbidden.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"422":{"description":"Validation failed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/agent-sessions/{id}/stop":{"post":{"operationId":"stopAgentSession","description":"Stop (cancel) a running or queued ai-agent monitor session. Proxies to the ai-agent service, minting a fresh CLI session for the caller so the ai-agent's own auth applies. Idempotent — stopping an already-terminal session is a 200 no-op.","x-speakeasy-group":"agentSessions","x-speakeasy-name-override":"stop","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Already terminal / no-op.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"202":{"description":"Cancel accepted; session stopped.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentSessionStopResponse"}}}},"404":{"description":"Not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"AI agent service is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins":{"get":{"operationId":"listOperationsPlugins","description":"List available operations plugins (builtin + custom) for a project, with their operations and risk tiers.","x-speakeasy-group":"operations","x-speakeasy-name-override":"listPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The operations plugin catalog.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ListOperationsPluginsResponse"}}}},"409":{"description":"A persisted custom plugin has invalid metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"publishOperationsPlugin","description":"Register a custom operations plugin whose bundle ZIP has already been uploaded to S3 (see POST /plugins/upload-url). Replaces any existing plugin of the same name in that project. New custom plugins are enabled by default. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"publishPlugin","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginRequest"}}}},"responses":{"201":{"description":"The plugin was published, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublishOperationsPluginResponse"}}}},"400":{"description":"Invalid metadata, or no bundle was uploaded for this name/version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"A plugin with this name is already published at this version.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/builtin/enabled":{"put":{"operationId":"setBuiltinOperationsPlugins","description":"Replace the complete set of enabled built-in operations plugins for a project. Returns the cloud permission delta versus the previously enabled set.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setBuiltinPlugins","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsRequest"}}}},"responses":{"200":{"description":"The enabled built-in plugin set was replaced, with the cloud permission delta.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetBuiltinOperationsPluginsResponse"}}}},"400":{"description":"One or more plugin names are invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/upload-url":{"post":{"operationId":"createOperationsBundleUploadUrl","description":"Get a presigned S3 URL to upload a custom operations plugin bundle ZIP. Upload the ZIP with a PUT to the returned url (sending the given Content-Type), then call POST /plugins to register it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"createBundleUploadUrl","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlRequest"}}}},"responses":{"200":{"description":"A presigned upload URL for the bundle ZIP.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsBundleUploadUrlResponse"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Bundle storage is not configured.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/plugins/{name}/enabled":{"patch":{"operationId":"setOperationsPluginEnabled","description":"Enable or disable an operations plugin (builtin or custom) for a project. Only enabled plugins are distributed to Operators and can be invoked. Returns the cloud permission delta versus the previously enabled set. With `dryRun`, validates the change and returns the delta without saving it.","x-speakeasy-group":"operations","x-speakeasy-name-override":"setPluginEnabled","parameters":[{"schema":{"type":"string","description":"Plugin name."},"required":true,"description":"Plugin name.","name":"name","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledRequest"}}}},"responses":{"200":{"description":"The plugin's enabled state was updated, with the cloud permission delta versus the previously enabled set.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetOperationsPluginEnabledResponse"}}}},"404":{"description":"No such plugin for this project.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The plugin metadata is invalid for the requested enabled state, or the permission delta differs from `expectedPermissionDiff`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/policy":{"get":{"operationId":"getOperationsPolicy","description":"Get a project's per-command approval policy. Mirrors what the operator enforces: `plugin/operation` / `plugin/*` / `*` patterns → auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"getPolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"The approval policy rules and default.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"put":{"operationId":"updateOperationsPolicy","description":"Replace a project's per-command approval policy (full rule set). Patterns are `plugin/operation`, `plugin/*`, or `*`; each maps to auto | manual.","x-speakeasy-group":"operations","x-speakeasy-name-override":"updatePolicy","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/UpdateOperationsPolicyRequest"}}}},"responses":{"200":{"description":"The updated approval policy.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OperationsPolicyResponse"}}}},"400":{"description":"Invalid request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/invoke":{"post":{"operationId":"invokeOperation","description":"Invoke a plugin operation against a deployment. Honors the project's per-command approval policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"invoke","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationRequest"}}}},"responses":{"200":{"description":"The operation was dispatched or queued for approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InvokeOperationResponse"}}}},"400":{"description":"Parameters do not satisfy the operation's published input schema.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"402":{"description":"Custom plugins require a higher plan tier.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not create commands for this deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Plugin or operation not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Plugin is disabled or has invalid persisted metadata.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/operations/verify-check":{"post":{"operationId":"verifyOperationCheck","description":"One verification poll cycle for an original operation command. Loads that command's authoritative stored result and dispatch-time verification contract, dispatches the frozen read-only poll operation once, and evaluates its frozen success condition. Callers poll this repeatedly per the returned policy.","x-speakeasy-group":"operations","x-speakeasy-name-override":"verifyCheck","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckRequest"}}}},"responses":{"200":{"description":"The outcome of this single verification poll cycle.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/VerifyOperationCheckResponse"}}}},"400":{"description":"The verification command cannot be dispatched to the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller may not dispatch verification commands.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or original command not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"502":{"description":"The manager returned an invalid verification command acknowledgement.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests":{"post":{"operationId":"createAccessRequest","description":"Create an access request — either plan-backed (an ai-agent investigation's exact commands) or plan-less (a CLI-originated exact operation or wildcard pattern, resolved and frozen here). Plan-backed requests await the engineer gate (status `pending-approval`); plan-less requests are queued immediately since the requester is asking for their own access (status `queued`).","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateAccessRequest"}}}},"responses":{"201":{"description":"The created access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"400":{"description":"Invalid create payload or requested expiry.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"The requester cannot access the target deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Deployment or remediation plan not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Replay key payload conflicts or the remediation plan already has a request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"get":{"operationId":"listAccessRequests","description":"List a project's access requests, newest first.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AccessRequestStatus"},"description":"Filter by status."},"required":false,"description":"Filter by status.","name":"status","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Filter by deployment ID.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":false,"description":"Filter by deployment ID.","name":"deploymentId","in":"query"},{"schema":{"type":"string","description":"Only requests proposed by this investigation's remediation plan."},"required":false,"description":"Only requests proposed by this investigation's remediation plan.","name":"agentSessionId","in":"query"},{"schema":{"type":"integer","minimum":1,"maximum":100,"default":20,"description":"Maximum number of items to return per page"},"required":false,"description":"Maximum number of items to return per page","name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor for pagination - omit for first page"},"required":false,"description":"Cursor for pagination - omit for first page","name":"cursor","in":"query"}],"responses":{"200":{"description":"The project's access requests.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]},"description":"Items in this page"},"nextCursor":{"type":"string","nullable":true,"description":"Cursor for the next page, null if last page"}},"required":["items","nextCursor"],"description":"Paginated response"}}}},"400":{"description":"Invalid cursor.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/queue":{"post":{"operationId":"queueAccessRequest","description":"Engineer gate — approve a pending access request, queuing it for the operator to materialize. Records who queued it.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The queued access request, with the customer approve command.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"kubectlApprove":{"type":"string","nullable":true}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","kubectlApprove"]}}}},"400":{"description":"The requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not pending approval.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/approve":{"post":{"operationId":"approveAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may approve a queued access request. Actor identity comes from authentication; method/source are audit context only.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}},"approvedForMinutes":{"type":"integer","minimum":0,"exclusiveMinimum":true}},"required":["method"]}}}},"responses":{"200":{"description":"The approved access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]},"approvalMethod":{"$ref":"#/components/schemas/AccessRequestApprovalMethod"}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy","approvalMethod"]}}}},"400":{"description":"The approval window or requester deadline has elapsed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued, or its requester identity is unknown and a new request is required.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/deny":{"post":{"operationId":"denyAccessRequest","description":"Customer gate — an authenticated workspace member or administrator other than the requester may reject a queued access request. Actor identity comes from authentication.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"method":{"type":"string","example":"slack"},"actorId":{"type":"string","description":"Deprecated and ignored. Actor identity comes from the authenticated user."},"source":{"type":"object","additionalProperties":{"nullable":true}}},"required":["method"]}}}},"responses":{"200":{"description":"The rejected access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"Requires an independent authenticated workspace member or administrator.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Access request is not queued (already approved, denied, expired, or still pending the engineer gate).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/coordinates":{"get":{"operationId":"getAccessRequestCoordinates","description":"The customer's kubectl approve command for a queued access request, or null until the operator has materialized the grant CR and reported its coordinates. Polled by the Slack handler to update the access-plan card.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The approve command (or null) and current status.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"kubectlApprove":{"type":"string","nullable":true}},"required":["status","kubectlApprove"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/pending":{"get":{"operationId":"listPendingAccessRequests","description":"Operator-facing: queued access requests whose requester deadline has not elapsed, for the access-request sync loop to materialize as grant CRs.","x-speakeasy-ignore":true,"parameters":[{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Queued access requests for the deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"requests":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"requestedExpiresAt":{"type":"string","nullable":true}},"required":["id","title","reason","commands","debugGrant","requestedExpiresAt"]}},"revokedRequestIds":{"type":"array","items":{"type":"string"},"description":"Requests revoked in the last six hours, or revoked while their approved window is still open, so the operator can mark their grant CRs REVOKED. Older operators ignore this field."}},"required":["requests","revokedRequestIds"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/materialized":{"post":{"operationId":"reportMaterializedAccessRequests","description":"Operator-facing: record the namespace + CRD plural the operator materialized the grant CRs in, so the control plane can render the customer's exact kubectl approve command.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"requestIds":{"type":"array","items":{"type":"string"}},"namespace":{"type":"string","minLength":1},"resourcePlural":{"type":"string","minLength":1}},"required":["deploymentId","requestIds","namespace","resourcePlural"]}}}},"responses":{"200":{"description":"Number of requests updated with CR coordinates.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/approvals":{"post":{"operationId":"reportAccessApprovals","description":"Operator-facing: record the customer's approval windows reported back by the sync loop. Retires requester-expired requests and skips stale windows without blocking live approvals. Moves live requests to customer-approved and resumes the investigation to dispatch commands.","x-speakeasy-ignore":true,"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"deploymentId":{"type":"string"},"approvals":{"type":"array","items":{"type":"object","properties":{"requestId":{"type":"string"},"approvedUntil":{"type":"string"}},"required":["requestId","approvedUntil"]}}},"required":["deploymentId","approvals"]}}}},"responses":{"200":{"description":"Number of approvals recorded.","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"number"}},"required":["recorded"]}}}},"400":{"description":"Invalid approval report payload.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"403":{"description":"Caller is not the deployment's manager runtime.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/live-debug-grant":{"get":{"operationId":"getLiveDebugGrant","description":"Find an approved, unexpired access request the caller created whose debug grant matches this deployment and tool (and, when given, namespace/cloudScope). Returns the most recently approved match, or 404 when none is live. Used to reuse an existing grant instead of proposing a new access request. Only the requester's own grants match: a debug session must present a grant its caller requested, so another principal's grant is never returned here.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"The deployment to check for a live debug grant.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"required":true,"description":"The deployment to check for a live debug grant.","name":"deploymentId","in":"query"},{"schema":{"$ref":"#/components/schemas/DebugGrantTool"},"required":true,"name":"debugTool","in":"query"},{"schema":{"type":"string","description":"Match a `kubectl` grant scoped to this namespace exactly."},"required":false,"description":"Match a `kubectl` grant scoped to this namespace exactly.","name":"debugNamespace","in":"query"},{"schema":{"type":"string","description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly."},"required":false,"description":"Match an `aws`/`gcloud`/`az` grant scoped to this account/project exactly.","name":"debugCloudScope","in":"query"}],"responses":{"200":{"description":"A live access request with a matching debug grant.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"No approved, unexpired access request matches.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/activity":{"get":{"operationId":"getAccessRequestActivity","description":"The operation commands and debug sessions an access request authorized, with each command's verification outcome. Authorized like getAccessRequest.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The request's operations and debug sessions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AccessRequestActivity"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}/revoke":{"post":{"operationId":"revokeAccessRequest","description":"Revoke a pending, queued or customer-approved access request. The principal that created the request, or any workspace member or administrator who can read its project, may revoke it. Commands the grant authorized that have not been dispatched are failed; dispatched commands finish. Linked debug sessions are stopped and refuse their next request. Revoking an already revoked request returns it unchanged.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RevokeAccessRequest"}}}},"responses":{"200":{"description":"The revoked access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"403":{"description":"The caller may read but not revoke this request.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The request has already expired or been rejected.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/access-requests/{id}":{"get":{"operationId":"getAccessRequest","description":"Get an access request by id.","x-speakeasy-group":"operations","parameters":[{"schema":{"type":"string"},"required":true,"name":"id","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"The access request.","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string"},"requesterKind":{"type":"string","nullable":true,"enum":["user","serviceAccount",null]},"requesterId":{"type":"string","nullable":true},"requestedExpiresAt":{"type":"string","nullable":true},"deploymentId":{"type":"string"},"deployment":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"deploymentGroup":{"$ref":"#/components/schemas/DeploymentGroupInfo"}},"required":["id","name"]},"remediationPlanId":{"type":"string","nullable":true},"agentSessionId":{"type":"string","nullable":true,"description":"The investigation whose remediation plan proposed this request, if a plan did."},"title":{"type":"string"},"reason":{"type":"string","nullable":true},"commands":{"type":"array","items":{"type":"object","properties":{"command":{"type":"string","example":"kubernetes/get-pods"},"summary":{"type":"string","example":"List pods in the ingestion namespace"},"params":{"nullable":true,"example":{"pod":"ingester-p4kwm"}},"tier":{"type":"string","enum":["read-only","mutating","destructive"],"description":"How risky an operation is (declared by the plugin metadata)."},"pluginVersion":{"type":"string","minLength":1},"operationContractHash":{"type":"string","pattern":"^[0-9a-f]{64}$"}},"required":["command","summary"]}},"operationPattern":{"type":"string","nullable":true},"maxRisk":{"type":"string","nullable":true,"enum":["read-only","mutating","destructive",null],"description":"How risky an operation is (declared by the plugin metadata)."},"debugGrant":{"$ref":"#/components/schemas/AccessRequestDebugGrant"},"status":{"$ref":"#/components/schemas/AccessRequestStatus"},"approvedUntil":{"type":"string","nullable":true},"createdAt":{"type":"string"},"queuedBy":{"type":"string","nullable":true,"description":"Who passed the engineer gate; the requester for a plan-less request."},"queuedAt":{"type":"string","nullable":true},"approvedBy":{"type":"object","nullable":true,"properties":{"method":{"type":"string","nullable":true,"description":"`kubectl` for the in-cluster path, else the direct caller's method such as `slack`."},"actorId":{"type":"string","nullable":true,"description":"The approving user. Null for the kubectl path: the approver is only in the customer's cluster audit log."},"at":{"type":"string"}},"required":["method","actorId","at"],"description":"How and when the customer gate was passed. Null until approved."},"deniedBy":{"type":"object","nullable":true,"properties":{"actorId":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["actorId","at"]},"revokedBy":{"type":"object","nullable":true,"properties":{"actorKind":{"type":"string","enum":["user","serviceAccount"]},"actorId":{"type":"string"},"at":{"type":"string"},"reason":{"type":"string","nullable":true}},"required":["actorKind","actorId","at","reason"]}},"required":["id","requesterKind","requesterId","requestedExpiresAt","deploymentId","remediationPlanId","agentSessionId","title","reason","commands","operationPattern","maxRisk","debugGrant","status","approvedUntil","createdAt","queuedBy","queuedAt","approvedBy","deniedBy","revokedBy"]}}}},"404":{"description":"Access request not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/list":{"post":{"operationId":"syncList","description":"List full deployment records for manager operational loops. This endpoint is intentionally separate from the public deployments list, which returns lightweight UI rows.","x-speakeasy-group":"sync","x-speakeasy-name-override":"list","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListRequest"}}}},"responses":{"200":{"description":"Full deployment records returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncListResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/context":{"post":{"operationId":"syncContext","description":"Get computed deployment state and configuration for a manager-side operation without acquiring the deployment reconciliation lock.","x-speakeasy-group":"sync","x-speakeasy-name-override":"context","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncContextRequest"}}}},"responses":{"200":{"description":"Computed deployment context returned successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponseDeployment"}}}},"404":{"description":"Deployment not found or not assigned to this manager.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Failed to build deployment context.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/acquire":{"post":{"operationId":"syncAcquire","description":"Acquire a batch of deployments for processing. Used by Manager to atomically lock deployments matching filters. Each deployment in the batch must be released after processing.","x-speakeasy-group":"sync","x-speakeasy-name-override":"acquire","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireRequest"}}}},"responses":{"200":{"description":"Deployments acquired successfully (empty arrays if none available). Failures indicate deployments that were locked but failed during context building - their locks have been released.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncAcquireResponse"}}}},"400":{"description":"Bad request - invalid manager or filters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/reconcile":{"post":{"operationId":"syncReconcile","description":"Reconcile deployment state. Push model requests that include a session verify lock ownership. Pull model state reports are accepted as authz-gated agent progress even when they carry an agent-sync session. Accepts full DeploymentState after step() execution.","x-speakeasy-group":"sync","x-speakeasy-name-override":"reconcile","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileRequest"}}}},"responses":{"200":{"description":"State reconciled successfully. If target is present, continue deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReconcileResponse"}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Deployment locked (pull) or session mismatch (push).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/renew":{"post":{"operationId":"syncRenew","x-speakeasy-group":"sync","x-speakeasy-name-override":"renew","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncRenewRequest"}}}},"responses":{"200":{"description":"Renewal processed. Inspect `leases` for per-deployment outcomes; a lost lease is reported there rather than failing the whole batch.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when every requested deployment was renewed."},"leases":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"},"renewed":{"type":"boolean","description":"False when this session no longer holds a live lease."},"leaseExpiresAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["deploymentId","renewed","leaseExpiresAt"]},"description":"Per-deployment renewal outcome."}},"required":["success","leases"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"The session no longer owns the deployment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/sync/release":{"post":{"operationId":"syncRelease","description":"Release a deployment lock. Must be called after processing an acquired deployment, even if processing failed. This is critical to avoid deadlocks.","x-speakeasy-group":"sync","x-speakeasy-name-override":"release","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/SyncReleaseRequest"}}}},"responses":{"200":{"description":"Lock released successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"success":{"type":"boolean","description":"True when released or the exact terminal receipt was acknowledged. False when completion could not be established."}},"required":["success"]}}}},"404":{"description":"Deployment not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources":{"get":{"operationId":"listInventory","x-speakeasy-group":"resources","x-speakeasy-name-override":"listInventory","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Unified managed and observed resource inventory rows.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"oneOf":[{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"},"source":{"type":"string","enum":["managed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt","source","deploymentId","deploymentName"]},{"type":"object","properties":{"source":{"type":"string","enum":["observed"]},"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"rawKind":{"type":"string"},"alienResourceId":{"type":"string","nullable":true},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["source","deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","name","rawKind","alienResourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}":{"get":{"operationId":"listResourceOverview","x-speakeasy-group":"resources","x-speakeasy-name-override":"listOverview","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Compute resource overview rows from latest heartbeats.","content":{"application/json":{"schema":{"type":"object","properties":{"resources":{"type":"array","items":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"name":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"deploymentCount":{"type":"integer"},"attentionCount":{"type":"integer"},"lastObservedAt":{"type":"string","format":"date-time"}},"required":["resourceType","resourceId","name","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","deploymentCount","attentionCount","lastObservedAt"]}}},"required":["resources"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/{resourceId}/deployments":{"get":{"operationId":"listResourceDeployments","description":"List deployments where the selected resource is installed.","x-speakeasy-group":"resources","x-speakeasy-name-override":"listDeployments","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}},{"schema":{"type":"string"},"required":false,"name":"deploymentGroupId","in":"query"},{"schema":{"type":"string"},"required":false,"name":"deploymentId","in":"query"}],"responses":{"200":{"description":"Deployments where the resource is installed.","content":{"application/json":{"schema":{"type":"object","properties":{"resourceType":{"type":"string"},"resourceId":{"type":"string"},"deployments":{"type":"array","items":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt"]}}},"required":["resourceType","resourceId","deployments"]}}}},"404":{"description":"Project not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resources/{area}/deployments/{deploymentId}/{resourceId}":{"get":{"operationId":"getResourceDeploymentDetail","x-speakeasy-group":"resources","x-speakeasy-name-override":"getDeploymentDetail","parameters":[{"schema":{"type":"string","enum":["container","worker","daemon","ai"]},"required":true,"name":"area","in":"path"},{"schema":{"type":"string"},"required":true,"name":"deploymentId","in":"path"},{"schema":{"type":"string"},"required":true,"name":"resourceId","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"Latest heartbeat detail for one resource deployment.","content":{"application/json":{"schema":{"type":"object","properties":{"deployment":{"type":"object","properties":{"deploymentId":{"type":"string"},"deploymentName":{"type":"string"},"deploymentGroupId":{"type":"string","nullable":true},"deploymentGroupName":{"type":"string","nullable":true},"resourceType":{"type":"string"},"resourceId":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"health":{"type":"string"},"lifecycle":{"type":"string"},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"providerStale":{"type":"boolean"},"platformStale":{"type":"boolean"},"desiredCount":{"type":"integer","nullable":true},"currentCount":{"type":"integer","nullable":true},"readyCount":{"type":"integer","nullable":true},"observedAt":{"type":"string","format":"date-time"},"desiredImage":{"type":"string","nullable":true}},"required":["deploymentId","deploymentName","deploymentGroupId","deploymentGroupName","resourceType","resourceId","backend","controllerPlatform","health","lifecycle","message","partial","providerStale","platformStale","desiredCount","currentCount","readyCount","observedAt","desiredImage"]},"heartbeat":{"oneOf":[{"type":"object","properties":{"status":{"type":"string","enum":["available"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"},"backend":{"type":"string"},"controllerPlatform":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"staleAt":{"type":"string","format":"date-time"},"platformStale":{"type":"boolean"},"heartbeat":{"type":"object","properties":{"backend":{"type":"string","enum":["aws","gcp","azure","kubernetes","local","managed","external","test"]},"controllerPlatform":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Represents the target cloud platform."},"data":{"oneOf":[{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"blockPublicAcls":{"type":"boolean","nullable":true},"blockPublicPolicy":{"type":"boolean","nullable":true},"bucketAclPresent":{"type":"boolean","nullable":true},"bucketLocation":{"type":"string","nullable":true},"bucketPolicyPresent":{"type":"boolean","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"encryptionEnabled":{"type":"boolean","nullable":true},"ignorePublicAcls":{"type":"boolean","nullable":true},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"publicAccessBlockPresent":{"type":"boolean"},"region":{"type":"string","nullable":true},"restrictPublicBuckets":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"versioningEnabled":{"type":"boolean","nullable":true},"versioningStatus":{"type":"string","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","publicAccessBlockPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsS3"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bucketId":{"type":"string","nullable":true},"defaultKmsKeyName":{"type":"string","nullable":true},"encryptionConfigPresent":{"type":"boolean"},"lifecyclePresent":{"type":"boolean"},"lifecycleRuleCount":{"type":"integer","nullable":true,"minimum":0},"location":{"type":"string","nullable":true},"locationType":{"type":"string","nullable":true},"name":{"type":"string"},"publicAccessPrevention":{"type":"string","nullable":true},"retentionPeriod":{"type":"string","nullable":true},"retentionPolicyEffectiveTime":{"type":"string","nullable":true},"retentionPolicyIsLocked":{"type":"boolean","nullable":true},"softDeleteEffectiveTime":{"type":"string","nullable":true},"softDeleteRetentionDurationSeconds":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageClass":{"type":"string","nullable":true},"uniformBucketLevelAccessEnabled":{"type":"boolean","nullable":true},"uniformBucketLevelAccessLockedTime":{"type":"string","nullable":true},"versioningEnabled":{"type":"boolean","nullable":true}},"required":["encryptionConfigPresent","lifecyclePresent","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudStorage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessTier":{"type":"string","nullable":true},"accountKind":{"type":"string","nullable":true},"allowBlobPublicAccess":{"type":"boolean","nullable":true},"blobDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"blobDeleteRetentionEnabled":{"type":"boolean","nullable":true},"blobEncryptionEnabled":{"type":"boolean","nullable":true},"blobVersioningEnabled":{"type":"boolean","nullable":true},"changeFeedEnabled":{"type":"boolean","nullable":true},"changeFeedRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionDays":{"type":"integer","nullable":true,"minimum":0},"containerDeleteRetentionEnabled":{"type":"boolean","nullable":true},"containerPublicAccess":{"type":"string","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"fileEncryptionEnabled":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"primaryLocation":{"type":"string","nullable":true},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"queueEncryptionEnabled":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"secondaryLocation":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"statusOfPrimary":{"type":"string","nullable":true},"statusOfSecondary":{"type":"string","nullable":true},"storageAccountName":{"type":"string","nullable":true},"tableEncryptionEnabled":{"type":"boolean","nullable":true}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureBlob"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["storage"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"codeSha256":{"type":"string","nullable":true},"functionName":{"type":"string"},"functionUrlAuthType":{"type":"string","nullable":true},"functionUrlCorsPresent":{"type":"boolean"},"lastModified":{"type":"string","nullable":true},"lastUpdateStatus":{"type":"string","nullable":true},"lastUpdateStatusReason":{"type":"string","nullable":true},"lastUpdateStatusReasonCode":{"type":"string","nullable":true},"layerCount":{"type":"integer","minimum":0},"memorySizeMb":{"type":"integer","nullable":true},"packageType":{"type":"string","nullable":true},"revisionId":{"type":"string","nullable":true},"runtime":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"stateReason":{"type":"string","nullable":true},"stateReasonCode":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutSeconds":{"type":"integer","nullable":true},"triggerCount":{"type":"integer","minimum":0},"version":{"type":"string","nullable":true}},"required":["functionName","functionUrlCorsPresent","layerCount","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsLambda"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"containerImage":{"type":"string","nullable":true},"cpuLimit":{"type":"string","nullable":true},"generation":{"type":"integer","nullable":true},"latestCreatedRevision":{"type":"string","nullable":true},"latestReadyRevision":{"type":"string","nullable":true},"maxInstanceCount":{"type":"integer","nullable":true},"memoryLimit":{"type":"string","nullable":true},"minInstanceCount":{"type":"integer","nullable":true},"observedGeneration":{"type":"integer","nullable":true},"region":{"type":"string","nullable":true},"service":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trafficCount":{"type":"integer","minimum":0},"uri":{"type":"string","nullable":true},"urls":{"type":"array","items":{"type":"string"}}},"required":["service","status","trafficCount","urls"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudRun"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appName":{"type":"string"},"cpu":{"type":"number","nullable":true},"environmentName":{"type":"string","nullable":true},"ingressFqdn":{"type":"string","nullable":true},"maxReplicas":{"type":"integer","nullable":true},"memory":{"type":"string","nullable":true},"minReplicas":{"type":"integer","nullable":true},"provisioningState":{"type":"string","nullable":true},"revision":{"type":"string","nullable":true},"runningStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["appName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","triggerCount","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"imagePathPresent":{"type":"boolean"},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pid":{"type":"integer","nullable":true,"minimum":0},"process":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"readinessProbeOk":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"triggerCount":{"type":"integer","minimum":0}},"required":["commandSupported","events","imagePathPresent","status","triggerCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["worker"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"attentionCount":{"type":"integer","minimum":0},"containerId":{"type":"string"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"image":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"observedImage":{"type":"string","nullable":true},"replicaUnits":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"schedulingMode":{"type":"string","enum":["replicated","stateful","daemon"]},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["attentionCount","containerId","events","replicaUnits","replicas","schedulingMode","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["horizonPlatform"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]},"workloadKind":{"type":"string","enum":["deployment","statefulSet","daemonSet","replicaSet","pod"]}},"required":["events","name","namespace","pods","replicas","status","workloadKind"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"bindMountCount":{"type":"integer","minimum":0},"containerId":{"type":"string","nullable":true},"containerUnit":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"image":{"type":"string","nullable":true},"localUrl":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string","nullable":true},"portCount":{"type":"integer","minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeReachable":{"type":"boolean"},"runtimeStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["bindMountCount","events","portCount","runtimeReachable","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["container"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"assignedMachines":{"type":"integer","minimum":0},"capacityGroup":{"type":"string"},"commandSupported":{"type":"boolean"},"daemonInstances":{"type":"array","items":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"ip":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"message":{"type":"string","nullable":true},"metricsHealthy":{"type":"boolean","nullable":true},"metricsLastUpdated":{"type":"string","nullable":true},"metricsStatus":{"type":"string","nullable":true},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"phase":{"type":"string","nullable":true},"ready":{"type":"boolean"},"reason":{"type":"string","nullable":true},"replicaId":{"type":"string"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"string","nullable":true},"terminatedReason":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ready","replicaId"]}},"daemonName":{"type":"string"},"desiredMachines":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"eventId":{"type":"string","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"details":{"oneOf":[{"nullable":true},{"nullable":true}]},"id":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"machineId":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"replicaId":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"healthyInstances":{"type":"integer","minimum":0},"horizonClusterId":{"type":"string"},"horizonStatus":{"type":"string"},"horizonStatusMessage":{"type":"string","nullable":true},"horizonStatusReason":{"type":"string","nullable":true},"latestUpdateTimestamp":{"type":"string"},"observedImage":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"unavailableInstances":{"type":"integer","minimum":0}},"required":["assignedMachines","capacityGroup","commandSupported","daemonInstances","desiredMachines","events","healthyInstances","horizonClusterId","horizonStatus","latestUpdateTimestamp","status","unavailableInstances"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string"},"pods":{"type":"array","items":{"type":"object","properties":{"containers":{"type":"array","items":{"type":"object","properties":{"digest":{"type":"string","nullable":true,"description":"Registry manifest digest in `sha256:<hex>` form, when the runtime\nreports one."},"image":{"type":"string","description":"Image reference reported by the container runtime."},"name":{"type":"string","description":"Container name."}},"required":["image","name"],"description":"Image a running container reports."}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodeName":{"type":"string","nullable":true},"ownerReferences":{"type":"array","items":{"type":"object","properties":{"controller":{"type":"boolean"},"kind":{"type":"string"},"name":{"type":"string"},"uid":{"type":"string"}},"required":["controller","kind","name","uid"]}},"phase":{"type":"string","nullable":true},"podIp":{"type":"string","nullable":true},"ready":{"type":"boolean"},"restartCount":{"type":"integer","minimum":0},"terminatedReason":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true},"waitingReason":{"type":"string","nullable":true}},"required":["name","ownerReferences","ready","restartCount"]}},"replicas":{"type":"object","properties":{"available":{"type":"integer","nullable":true,"minimum":0},"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"misscheduled":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0},"updated":{"type":"integer","nullable":true,"minimum":0}}},"restarts":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workload":{"oneOf":[{"type":"object","properties":{"availableReplicas":{"type":"integer","nullable":true,"minimum":0},"conditions":{"type":"array","items":{"type":"object","properties":{"lastTransitionTime":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"desiredGeneration":{"type":"integer","nullable":true},"desiredReplicas":{"type":"integer","nullable":true,"minimum":0},"observedGeneration":{"type":"integer","nullable":true},"readyReplicas":{"type":"integer","nullable":true,"minimum":0},"rolloutReason":{"type":"string","nullable":true},"updatedReplicas":{"type":"integer","nullable":true,"minimum":0}},"required":["conditions"]},{"nullable":true}]}},"required":["commandSupported","events","name","namespace","pods","replicas","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetes"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"commandSupported":{"type":"boolean"},"daemonInstance":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"kind":{"type":"string","enum":["container","process","daemon"]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"phase":{"type":"string","nullable":true},"pid":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"boolean"},"restartCount":{"type":"integer","nullable":true,"minimum":0},"unitId":{"type":"string"}},"required":["kind","name","ready","unitId"]},{"nullable":true}]},"daemonName":{"type":"string"},"events":{"type":"array","items":{"type":"object","properties":{"kind":{"type":"string"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"severity":{"type":"string","enum":["info","warning","error"]},"subject":{"oneOf":[{"type":"object","properties":{"id":{"type":"string","nullable":true},"kind":{"type":"string"},"name":{"type":"string","nullable":true}},"required":["kind"]},{"nullable":true}]},"timestamp":{"type":"string","format":"date-time"}},"required":["kind","message","severity","timestamp"]}},"exitReason":{"type":"string","nullable":true},"imagePathPresent":{"type":"boolean"},"pid":{"type":"integer","nullable":true,"minimum":0},"restartCount":{"type":"integer","nullable":true,"minimum":0},"runtimeId":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["commandSupported","events","imagePathPresent","runtimeId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["daemon"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aws"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcp"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"providerFleets":{"type":"array","items":{"type":"object","properties":{"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"groupId":{"type":"string"},"location":{"type":"string","nullable":true},"providerId":{"type":"string"}},"required":["currentMachines","desiredMachines","groupId","providerId"]}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","name","nodes","providerFleets","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azure"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"backendClusterId":{"type":"string","nullable":true},"capacityGroups":{"type":"array","items":{"type":"object","properties":{"capacityBlocker":{"oneOf":[{"type":"object","properties":{"category":{"type":"string","enum":["quota","capacity","allocation","other"]},"message":{"type":"string"},"observedAt":{"type":"string","format":"date-time"},"providerCode":{"type":"string","nullable":true},"providerReference":{"type":"string","nullable":true}},"required":["category","message","observedAt"]},{"nullable":true}]},"currentMachines":{"type":"integer","minimum":0},"desiredMachines":{"type":"integer","minimum":0},"drainProgress":{"oneOf":[{"type":"object","properties":{"blockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"force":{"type":"boolean"},"machineId":{"type":"string"},"replicaCount":{"type":"integer"},"stalled":{"type":"boolean"},"status":{"type":"string","enum":["draining","drained","terminating"]}},"required":["force","machineId","replicaCount","stalled","status"]},{"nullable":true}]},"groupId":{"type":"string"},"instanceType":{"type":"string","nullable":true},"maxMachines":{"type":"integer","nullable":true,"minimum":0},"minMachines":{"type":"integer","nullable":true,"minimum":0},"recommendation":{"oneOf":[{"type":"object","properties":{"desiredMachines":{"type":"integer","minimum":0},"reason":{"type":"string","nullable":true},"unschedulableReplicas":{"type":"integer","nullable":true,"minimum":0},"utilization":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}},"required":["desiredMachines"]},{"nullable":true}]}},"required":["currentMachines","desiredMachines","groupId"]}},"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"machines":{"type":"array","items":{"type":"object","properties":{"capacityGroup":{"type":"string"},"cpuCores":{"type":"number","nullable":true},"drainBlockers":{"type":"array","items":{"type":"object","properties":{"reason":{"type":"string"},"replicaId":{"type":"string"},"schedulingMode":{"type":"string"},"state":{"type":"string"},"workloadName":{"type":"string"}},"required":["reason","replicaId","schedulingMode","state","workloadName"]}},"drainDeadlineAt":{"type":"string","nullable":true},"drainForce":{"type":"boolean"},"drainRequestedAt":{"type":"string","nullable":true},"drainedAt":{"type":"string","nullable":true},"horizondVersion":{"type":"string","nullable":true},"lastHeartbeat":{"type":"string"},"machineId":{"type":"string"},"memoryBytes":{"type":"integer","nullable":true},"overlayIp":{"type":"string","nullable":true},"publicIp":{"type":"string","nullable":true},"replicaCount":{"type":"integer"},"status":{"type":"string"},"zone":{"type":"string"}},"required":["capacityGroup","drainForce","lastHeartbeat","machineId","replicaCount","status","zone"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["capacityGroups","machines","name","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["machines"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"dockerApiVersion":{"type":"string","nullable":true},"dockerArch":{"type":"string","nullable":true},"dockerAvailable":{"type":"boolean"},"dockerOs":{"type":"string","nullable":true},"dockerVersion":{"type":"string","nullable":true},"hostIdentifier":{"type":"string","nullable":true},"name":{"type":"string"},"networkAvailable":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"nodes":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"runningContainers":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"trackedContainers":{"type":"integer","nullable":true,"minimum":0}},"required":["dockerAvailable","name","networkAvailable","nodes","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["compute-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"name":{"type":"string"},"namespace":{"type":"string","nullable":true},"nodeCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"nodeStatuses":{"type":"array","items":{"type":"object","properties":{"allocatable":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"capacity":{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"pods":{"type":"integer","nullable":true,"minimum":0}}},"conditions":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string","nullable":true},"reason":{"type":"string","nullable":true},"status":{"type":"string"},"type":{"type":"string"}},"required":["status","type"]}},"containerRuntimeVersion":{"type":"string","nullable":true},"kubeletVersion":{"type":"string","nullable":true},"labels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"ready":{"type":"boolean"},"roles":{"type":"array","items":{"type":"string"}},"uid":{"type":"string","nullable":true},"usage":{"oneOf":[{"type":"object","properties":{"cpu":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]},"memory":{"oneOf":[{"type":"object","properties":{"unit":{"type":"string","enum":["count","percent","bytes","cores","milliseconds","requests-per-second"]},"value":{"type":"number"}},"required":["unit","value"]},{"nullable":true}]}}},{"nullable":true}]}},"required":["allocatable","capacity","labels","name","ready","roles"]}},"podCounts":{"type":"object","properties":{"current":{"type":"integer","nullable":true,"minimum":0},"desired":{"type":"integer","nullable":true,"minimum":0},"ready":{"type":"integer","nullable":true,"minimum":0}}},"region":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["events","name","nodeCounts","podCounts","status"]},"resourceType":{"type":"string","enum":["kubernetes-cluster"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"approximateCounts":{"type":"boolean"},"approximateDelayedMessages":{"type":"integer","nullable":true,"minimum":0},"approximateInFlightMessages":{"type":"integer","nullable":true,"minimum":0},"approximateVisibleMessages":{"type":"integer","nullable":true,"minimum":0},"contentBasedDeduplication":{"type":"boolean","nullable":true},"deduplicationScope":{"type":"string","nullable":true},"delaySeconds":{"type":"integer","nullable":true,"minimum":0},"fifoQueue":{"type":"boolean","nullable":true},"fifoThroughputLimit":{"type":"string","nullable":true},"kmsDataKeyReusePeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"kmsMasterKeyId":{"type":"string","nullable":true},"maximumMessageSize":{"type":"integer","nullable":true,"minimum":0},"messageRetentionPeriodSeconds":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"queueArn":{"type":"string","nullable":true},"queueUrl":{"type":"string","nullable":true},"receiveMessageWaitTimeSeconds":{"type":"integer","nullable":true,"minimum":0},"redriveAllowPolicy":{"type":"string","nullable":true},"redrivePolicy":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"sqsManagedSseEnabled":{"type":"boolean","nullable":true},"sseEnabled":{"type":"boolean","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"visibilityTimeoutSeconds":{"type":"integer","nullable":true,"minimum":0}},"required":["approximateCounts","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsSqs"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"kmsKeyName":{"type":"string","nullable":true},"messageStorageAllowedPersistenceRegions":{"type":"array","items":{"type":"string"}},"messageStorageEnforceInTransit":{"type":"boolean","nullable":true},"projectId":{"type":"string","nullable":true},"schemaEncoding":{"type":"string","nullable":true},"schemaFirstRevisionId":{"type":"string","nullable":true},"schemaLastRevisionId":{"type":"string","nullable":true},"schemaName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subscriptionAckDeadlineSeconds":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterMaxDeliveryAttempts":{"type":"integer","nullable":true,"minimum":0},"subscriptionDeadLetterTopic":{"type":"string","nullable":true},"subscriptionDetached":{"type":"boolean","nullable":true},"subscriptionEnableMessageOrdering":{"type":"boolean","nullable":true},"subscriptionFilter":{"type":"string","nullable":true},"subscriptionFullName":{"type":"string","nullable":true},"subscriptionLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionMessageRetentionDuration":{"type":"string","nullable":true},"subscriptionName":{"type":"string","nullable":true},"subscriptionPushAttributes":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"subscriptionPushConfigPresent":{"type":"boolean","nullable":true},"subscriptionPushEndpoint":{"type":"string","nullable":true},"subscriptionPushNoWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionPushOidcAudience":{"type":"string","nullable":true},"subscriptionPushOidcServiceAccountEmail":{"type":"string","nullable":true},"subscriptionPushPubsubWrapperWriteMetadata":{"type":"boolean","nullable":true},"subscriptionRetainAckedMessages":{"type":"boolean","nullable":true},"subscriptionState":{"type":"string","nullable":true},"topicFullName":{"type":"string","nullable":true},"topicLabels":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"topicMessageRetentionDuration":{"type":"string","nullable":true},"topicName":{"type":"string"},"topicState":{"type":"string","nullable":true}},"required":["messageStorageAllowedPersistenceRegions","status","subscriptionLabels","subscriptionPushAttributes","topicLabels","topicName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpPubSub"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessedAt":{"type":"string","nullable":true},"activeMessageCount":{"type":"integer","nullable":true,"minimum":0},"autoDeleteOnIdle":{"type":"string","nullable":true},"createdAt":{"type":"string","nullable":true},"deadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"deadLetteringOnMessageExpiration":{"type":"boolean","nullable":true},"defaultMessageTimeToLive":{"type":"string","nullable":true},"duplicateDetectionHistoryTimeWindow":{"type":"string","nullable":true},"enableBatchedOperations":{"type":"boolean","nullable":true},"enableExpress":{"type":"boolean","nullable":true},"enablePartitioning":{"type":"boolean","nullable":true},"endpoint":{"type":"string","nullable":true},"forwardDeadLetteredMessagesTo":{"type":"string","nullable":true},"forwardTo":{"type":"string","nullable":true},"lockDuration":{"type":"string","nullable":true},"maxDeliveryCount":{"type":"integer","nullable":true,"minimum":0},"maxMessageSizeInKilobytes":{"type":"integer","nullable":true,"minimum":0},"maxSizeInMegabytes":{"type":"integer","nullable":true,"minimum":0},"messageCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"namespaceName":{"type":"string"},"queueStatus":{"type":"string","nullable":true},"requiresDuplicateDetection":{"type":"boolean","nullable":true},"requiresSession":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"scheduledMessageCount":{"type":"integer","nullable":true,"minimum":0},"sizeInBytes":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"transferDeadLetterMessageCount":{"type":"integer","nullable":true,"minimum":0},"transferMessageCount":{"type":"integer","nullable":true,"minimum":0},"updatedAt":{"type":"string","nullable":true}},"required":["name","namespaceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureServiceBus"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"path":{"type":"string","nullable":true},"serviceStatus":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["queue"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"billingMode":{"type":"string","nullable":true},"deletionProtectionEnabled":{"type":"boolean","nullable":true},"globalSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"itemCount":{"type":"integer","nullable":true,"minimum":0},"keySchema":{"type":"array","items":{"type":"object","properties":{"attributeName":{"type":"string"},"keyType":{"type":"string"}},"required":["attributeName","keyType"]}},"localSecondaryIndexCount":{"type":"integer","nullable":true,"minimum":0},"name":{"type":"string"},"region":{"type":"string","nullable":true},"replicaCount":{"type":"integer","nullable":true,"minimum":0},"restoreInProgress":{"type":"boolean","nullable":true},"sseStatus":{"type":"string","nullable":true},"sseType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"streamEnabled":{"type":"boolean","nullable":true},"streamViewType":{"type":"string","nullable":true},"tableArn":{"type":"string","nullable":true},"tableClass":{"type":"string","nullable":true},"tableSizeBytes":{"type":"integer","nullable":true,"minimum":0},"tableStatus":{"type":"string","nullable":true},"ttlAttributeName":{"type":"string","nullable":true},"ttlStatus":{"type":"string","nullable":true}},"required":["keySchema","name","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsDynamoDb"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"appEngineIntegrationMode":{"type":"string","nullable":true},"cmekEnabled":{"type":"boolean"},"concurrencyMode":{"type":"string","nullable":true},"createTime":{"type":"string","nullable":true},"databaseEdition":{"type":"string","nullable":true},"databaseName":{"type":"string"},"databaseType":{"type":"string","nullable":true},"deleteProtectionState":{"type":"string","nullable":true},"deleteTime":{"type":"string","nullable":true},"earliestVersionTime":{"type":"string","nullable":true},"endpoint":{"type":"string","nullable":true},"locationId":{"type":"string","nullable":true},"pointInTimeRecoveryEnablement":{"type":"string","nullable":true},"projectId":{"type":"string","nullable":true},"sourceInfoPresent":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true},"versionRetentionPeriod":{"type":"string","nullable":true}},"required":["cmekEnabled","databaseName","sourceInfoPresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpFirestore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"endpoint":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"signedIdentifierCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"storageAccountKind":{"type":"string","nullable":true},"storageAccountLocation":{"type":"string","nullable":true},"storageAccountName":{"type":"string"},"storageAccountPrimaryStatus":{"type":"string","nullable":true},"storageAccountProvisioningState":{"type":"string","nullable":true},"storageAccountResourceId":{"type":"string","nullable":true},"tableExists":{"type":"boolean"},"tableName":{"type":"string"}},"required":["status","storageAccountName","tableExists","tableName"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureTable"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cloudMetadataSupported":{"type":"boolean"},"isDirectory":{"type":"boolean","nullable":true},"name":{"type":"string"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["cloudMetadataSupported","name","path","pathExists","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["kv"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"clusterIdentifier":{"type":"string"},"endpoint":{"type":"string","nullable":true},"engineVersion":{"type":"string","nullable":true},"neverPauses":{"type":"boolean","description":"True when a `minCapacity: 0` instance has not reached 0 ACU over the observation\nwindow — it is silently paying always-on prices (auto-pause verification)."},"serverlessCapacity":{"type":"number","nullable":true,"description":"Latest sampled `ServerlessDatabaseCapacity` (ACU)."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["clusterIdentifier","neverPauses","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["aurora"]}},"required":["backend"]}],"description":"AWS Aurora Serverless v2 backend."},{"allOf":[{"type":"object","properties":{"databaseVersion":{"type":"string","nullable":true},"instanceName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["instanceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["cloudSql"]}},"required":["backend"]}],"description":"GCP Cloud SQL backend."},{"allOf":[{"type":"object","properties":{"serverName":{"type":"string"},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string","nullable":true}},"required":["serverName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["flexibleServer"]}},"required":["backend"]}],"description":"Azure Flexible Server backend."},{"allOf":[{"type":"object","properties":{"name":{"type":"string"},"port":{"type":"integer","nullable":true,"minimum":0},"processRunning":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"version":{"type":"string"}},"required":["name","processRunning","status","version"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local embedded Postgres backend."}]},"resourceType":{"type":"string","enum":["postgres"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"accountId":{"type":"string"},"hasMoreParameters":{"type":"boolean","nullable":true},"latestModifiedAt":{"type":"string","nullable":true,"format":"date-time"},"parameterMetadataSampled":{"type":"boolean"},"prefix":{"type":"string"},"region":{"type":"string"},"sampledAdvancedTierCount":{"type":"integer","nullable":true,"minimum":0},"sampledKmsKeyMetadataPresentCount":{"type":"integer","nullable":true,"minimum":0},"sampledParameterCount":{"type":"integer","nullable":true,"minimum":0},"sampledSecureStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringCount":{"type":"integer","nullable":true,"minimum":0},"sampledStringListCount":{"type":"integer","nullable":true,"minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountId","parameterMetadataSampled","prefix","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsParameterStore"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"location":{"type":"string"},"prefix":{"type":"string"},"projectId":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["location","prefix","projectId","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpSecretManager"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accessPolicyCount":{"type":"integer","minimum":0},"location":{"type":"string","nullable":true},"name":{"type":"string"},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"purgeProtectionEnabled":{"type":"boolean","nullable":true},"rbacAuthorizationEnabled":{"type":"boolean"},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secretMetadataListed":{"type":"boolean"},"skuFamily":{"type":"string","nullable":true},"skuName":{"type":"string","nullable":true},"softDeleteEnabled":{"type":"boolean"},"softDeleteRetentionDays":{"type":"integer"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vaultUri":{"type":"string","nullable":true}},"required":["accessPolicyCount","name","privateEndpointConnectionCount","publicNetworkAccess","rbacAuthorizationEnabled","secretMetadataListed","softDeleteEnabled","softDeleteRetentionDays","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureKeyVault"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"prefix":{"type":"string"},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","prefix","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesSecret"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"isDirectory":{"type":"boolean","nullable":true},"modifiedAt":{"type":"string","nullable":true,"format":"date-time"},"path":{"type":"string"},"pathExists":{"type":"boolean"},"readonly":{"type":"boolean","nullable":true},"secretMetadataListed":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["path","pathExists","secretMetadataListed","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["vault"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"assumeRolePolicyPresent":{"type":"boolean"},"attachedPolicyCount":{"type":"integer","minimum":0},"attachedPolicyNames":{"type":"array","items":{"type":"string"}},"createDate":{"type":"string"},"description":{"type":"string","nullable":true},"inlinePolicyCount":{"type":"integer","minimum":0},"inlinePolicyNames":{"type":"array","items":{"type":"string"}},"lastUsedDate":{"type":"string","nullable":true},"lastUsedRegion":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"maxSessionDuration":{"type":"integer","nullable":true},"path":{"type":"string"},"permissionsBoundaryArn":{"type":"string","nullable":true},"permissionsBoundaryType":{"type":"string","nullable":true},"roleArn":{"type":"string"},"roleId":{"type":"string"},"roleName":{"type":"string"},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tagCount":{"type":"integer","minimum":0}},"required":["assumeRolePolicyPresent","attachedPolicyCount","attachedPolicyNames","createDate","inlinePolicyCount","inlinePolicyNames","managedTagCount","path","roleArn","roleId","roleName","stackPermissionsApplied","status","tagCount"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"description":{"type":"string","nullable":true},"disabled":{"type":"boolean","nullable":true},"displayName":{"type":"string","nullable":true},"email":{"type":"string"},"etag":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"oauth2ClientId":{"type":"string","nullable":true},"projectBindingCount":{"type":"integer","minimum":0},"projectId":{"type":"string","nullable":true},"projectRoles":{"type":"array","items":{"type":"string"}},"serviceAccountBindingCount":{"type":"integer","minimum":0},"serviceAccountRoles":{"type":"array","items":{"type":"string"}},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"uniqueId":{"type":"string","nullable":true}},"required":["email","projectBindingCount","projectRoles","serviceAccountBindingCount","serviceAccountRoles","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"clientId":{"type":"string","nullable":true},"customRoleDefinitionCount":{"type":"integer","minimum":0},"customRoleDefinitionIds":{"type":"array","items":{"type":"string"}},"isolationScope":{"type":"string","nullable":true},"location":{"type":"string"},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"principalId":{"type":"string","nullable":true},"resourceGroup":{"type":"string"},"resourceId":{"type":"string"},"roleAssignmentCount":{"type":"integer","minimum":0},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"stackPermissionsApplied":{"type":"boolean"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"type":{"type":"string","nullable":true}},"required":["customRoleDefinitionCount","customRoleDefinitionIds","location","managedTagCount","name","resourceGroup","resourceId","roleAssignmentCount","roleAssignmentIds","stackPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"configured":{"type":"boolean"},"identity":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["configured","identity","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service-account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availabilityZones":{"type":"array","items":{"type":"string"}},"cidrBlock":{"type":"string","nullable":true},"internetGatewayId":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"natGatewayId":{"type":"string","nullable":true},"privateSubnetIds":{"type":"array","items":{"type":"string"}},"publicSubnetIds":{"type":"array","items":{"type":"string"}},"routeTableCount":{"type":"integer","minimum":0},"securityGroupId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vpcId":{"type":"string","nullable":true},"vpcState":{"type":"string","nullable":true}},"required":["availabilityZones","isByoVpc","privateSubnetIds","publicSubnetIds","routeTableCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cidrBlock":{"type":"string","nullable":true},"cloudNatName":{"type":"string","nullable":true},"firewallName":{"type":"string","nullable":true},"isByoVpc":{"type":"boolean"},"networkName":{"type":"string","nullable":true},"networkSelfLink":{"type":"string","nullable":true},"region":{"type":"string","nullable":true},"routerName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"subnetworkName":{"type":"string","nullable":true},"subnetworkSelfLink":{"type":"string","nullable":true}},"required":["isByoVpc","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVpc"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"applicationGatewaySubnetName":{"type":"string","nullable":true},"cidrBlock":{"type":"string","nullable":true},"isByoVnet":{"type":"boolean"},"lastByoVnetVerificationErrorCode":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"natGatewayId":{"type":"string","nullable":true},"nsgId":{"type":"string","nullable":true},"privateEndpointSubnetName":{"type":"string","nullable":true},"privateSubnetName":{"type":"string","nullable":true},"publicIpId":{"type":"string","nullable":true},"publicSubnetName":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"vnetName":{"type":"string","nullable":true},"vnetResourceId":{"type":"string","nullable":true}},"required":["isByoVnet","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureVnet"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["network"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"managementPermissionsApplied":{"type":"boolean"},"roleArn":{"type":"string","nullable":true},"roleName":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managementPermissionsApplied","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsIamRole"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"impersonationGranted":{"type":"boolean"},"roleBound":{"type":"boolean"},"serviceAccountEmail":{"type":"string","nullable":true},"serviceAccountUniqueId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["impersonationGranted","roleBound","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceAccount"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"ficName":{"type":"string","nullable":true},"roleAssignmentIds":{"type":"array","items":{"type":"string"}},"roleDefinitionId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"tenantId":{"type":"string","nullable":true},"uamiClientId":{"type":"string","nullable":true},"uamiPrincipalId":{"type":"string","nullable":true},"uamiResourceId":{"type":"string","nullable":true}},"required":["roleAssignmentIds","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureManagedIdentity"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["remote-stack-management"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"pullRoleArn":{"type":"string","nullable":true},"pushRoleArn":{"type":"string","nullable":true},"region":{"type":"string"},"registryId":{"type":"string"},"registryUri":{"type":"string"},"repositories":{"type":"array","items":{"type":"object","properties":{"createdAt":{"type":"number"},"encryptionType":{"type":"string","nullable":true},"imageTagMutability":{"type":"string","nullable":true},"kmsKeyPresent":{"type":"boolean"},"registryId":{"type":"string"},"repositoryArn":{"type":"string"},"repositoryName":{"type":"string"},"repositoryUri":{"type":"string"},"scanOnPush":{"type":"boolean","nullable":true}},"required":["createdAt","kmsKeyPresent","registryId","repositoryArn","repositoryName","repositoryUri"]}},"repositoriesTruncated":{"type":"boolean"},"repositoryCount":{"type":"integer","minimum":0},"repositoryPrefix":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["region","registryId","registryUri","repositories","repositoriesTruncated","repositoryCount","repositoryPrefix","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsEcr"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"cleanupPolicyCount":{"type":"integer","minimum":0},"cleanupPolicyDryRun":{"type":"boolean","nullable":true},"createTime":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"format":{"type":"string","nullable":true},"iamBindingCount":{"type":"integer","minimum":0},"iamPolicyEtagPresent":{"type":"boolean"},"iamRoles":{"type":"array","items":{"type":"string"}},"kmsKeyNamePresent":{"type":"boolean"},"labelCount":{"type":"integer","minimum":0},"location":{"type":"string"},"mode":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"projectId":{"type":"string"},"pullServiceAccountEmail":{"type":"string","nullable":true},"pushServiceAccountEmail":{"type":"string","nullable":true},"repositoryId":{"type":"string"},"satisfiesPzs":{"type":"boolean","nullable":true},"sizeBytes":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updateTime":{"type":"string","nullable":true}},"required":["cleanupPolicyCount","iamBindingCount","iamPolicyEtagPresent","iamRoles","kmsKeyNamePresent","labelCount","location","projectId","repositoryId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpArtifactRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"adminUserEnabled":{"type":"boolean"},"anonymousPullEnabled":{"type":"boolean"},"creationDate":{"type":"string","nullable":true},"dataEndpointEnabled":{"type":"boolean","nullable":true},"dataEndpointHostNames":{"type":"array","items":{"type":"string"}},"encryptionKeyIdentifierPresent":{"type":"boolean"},"encryptionKeyVaultUriPresent":{"type":"boolean"},"encryptionStatus":{"type":"string","nullable":true},"ipRuleCount":{"type":"integer","minimum":0},"location":{"type":"string"},"loginServer":{"type":"string","nullable":true},"managedTagCount":{"type":"integer","minimum":0},"name":{"type":"string"},"networkRuleBypassOptions":{"type":"string"},"networkRuleDefaultAction":{"type":"string","nullable":true},"policiesPresent":{"type":"boolean"},"policyCount":{"type":"integer","minimum":0},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string"},"resourceGroup":{"type":"string"},"resourceId":{"type":"string","nullable":true},"skuName":{"type":"string"},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"type":{"type":"string","nullable":true},"zoneRedundancy":{"type":"string"}},"required":["adminUserEnabled","anonymousPullEnabled","dataEndpointHostNames","encryptionKeyIdentifierPresent","encryptionKeyVaultUriPresent","ipRuleCount","location","managedTagCount","name","networkRuleBypassOptions","policiesPresent","policyCount","privateEndpointConnectionCount","publicNetworkAccess","resourceGroup","skuName","status","zoneRedundancy"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerRegistry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"reachable":{"type":"boolean"},"registryUrl":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["reachable","registryUrl","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["artifact-registry"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"artifactsEncryptionDisabled":{"type":"boolean","nullable":true},"artifactsType":{"type":"string","nullable":true},"cloudWatchLogsStatus":{"type":"string","nullable":true},"computeType":{"type":"string","nullable":true},"created":{"type":"number","nullable":true},"description":{"type":"string","nullable":true},"encryptionKeyPresent":{"type":"boolean"},"environmentImage":{"type":"string","nullable":true},"environmentType":{"type":"string","nullable":true},"environmentVariableCount":{"type":"integer","minimum":0},"imagePullCredentialsType":{"type":"string","nullable":true},"lastModified":{"type":"number","nullable":true},"privilegedMode":{"type":"boolean","nullable":true},"projectArn":{"type":"string","nullable":true},"projectName":{"type":"string"},"queuedTimeoutInMinutes":{"type":"integer","nullable":true},"s3LogsStatus":{"type":"string","nullable":true},"serviceRolePresent":{"type":"boolean"},"sourceType":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"timeoutInMinutes":{"type":"integer","nullable":true}},"required":["encryptionKeyPresent","environmentVariableCount","projectName","serviceRolePresent","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsCodeBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"buildConfigId":{"type":"string"},"environmentVariableCount":{"type":"integer","minimum":0},"location":{"type":"string"},"projectId":{"type":"string"},"serviceAccount":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["buildConfigId","environmentVariableCount","location","projectId","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpCloudBuild"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"environmentVariableCount":{"type":"integer","minimum":0},"managedEnvironmentId":{"type":"string"},"managedIdentityId":{"type":"string","nullable":true},"resourceGroupName":{"type":"string"},"resourcePrefix":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["environmentVariableCount","managedEnvironmentId","resourceGroupName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureContainerApps"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"active":{"type":"integer","nullable":true},"completionTime":{"type":"string","nullable":true,"format":"date-time"},"conditionCount":{"type":"integer","minimum":0},"events":{"type":"array","items":{"type":"object","properties":{"count":{"type":"integer","nullable":true},"eventTime":{"type":"string","nullable":true,"format":"date-time"},"firstTimestamp":{"type":"string","nullable":true,"format":"date-time"},"involvedObject":{"oneOf":[{"type":"object","properties":{"apiVersion":{"type":"string","nullable":true},"fieldPath":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"name":{"type":"string","nullable":true},"namespace":{"type":"string","nullable":true},"resourceVersion":{"type":"string","nullable":true},"uid":{"type":"string","nullable":true}}},{"nullable":true}]},"lastTimestamp":{"type":"string","nullable":true,"format":"date-time"},"message":{"type":"string"},"raw":{"oneOf":[{"nullable":true},{"nullable":true}]},"reason":{"type":"string"},"source":{"oneOf":[{"type":"object","properties":{"component":{"type":"string","nullable":true},"host":{"type":"string","nullable":true}}},{"nullable":true}]},"type":{"type":"string","nullable":true}},"required":["message","reason"]}},"failed":{"type":"integer","nullable":true},"imageDigest":{"type":"string","nullable":true},"jobName":{"type":"string"},"namespace":{"type":"string"},"startTime":{"type":"string","nullable":true,"format":"date-time"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"succeeded":{"type":"integer","nullable":true}},"required":["conditionCount","events","jobName","namespace","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesJob"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["build"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"enabled":{"type":"boolean"},"lastOperationName":{"type":"string","nullable":true},"projectId":{"type":"string"},"serviceName":{"type":"string"},"serviceResourceName":{"type":"string","nullable":true},"state":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"title":{"type":"string","nullable":true}},"required":["enabled","projectId","serviceName","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpServiceUsage"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"namespace":{"type":"string"},"providerId":{"type":"string","nullable":true},"registered":{"type":"boolean"},"registrationPolicy":{"type":"string","nullable":true},"registrationState":{"type":"string","nullable":true},"resourceTypeCount":{"type":"integer","minimum":0},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["namespace","registered","resourceTypeCount","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureResourceProvider"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["service_activation"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"location":{"type":"string","nullable":true},"managedTags":{"type":"object","properties":{},"additionalProperties":{"type":"string"}},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["managedTags","name","status"]},"resourceType":{"type":"string","enum":["azure_resource_group"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"allowBlobPublicAccess":{"type":"boolean","nullable":true},"allowSharedKeyAccess":{"type":"boolean","nullable":true},"encryptionKeySource":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"networkBypass":{"type":"string","nullable":true},"networkDefaultAction":{"type":"string","nullable":true},"networkIpRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkResourceAccessRuleCount":{"type":"integer","nullable":true,"minimum":0},"networkVirtualNetworkRuleCount":{"type":"integer","nullable":true,"minimum":0},"primaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"requireInfrastructureEncryption":{"type":"boolean","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"secondaryEndpoints":{"type":"object","properties":{"blob":{"type":"string","nullable":true},"dfs":{"type":"string","nullable":true},"file":{"type":"string","nullable":true},"queue":{"type":"string","nullable":true},"table":{"type":"string","nullable":true},"web":{"type":"string","nullable":true}}},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"supportsHttpsTrafficOnly":{"type":"boolean","nullable":true}},"required":["name","primaryEndpoints","secondaryEndpoints","status"]},"resourceType":{"type":"string","enum":["azure_storage_account"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"customDomainVerificationId":{"type":"string","nullable":true},"defaultDomain":{"type":"string","nullable":true},"eventStreamEndpoint":{"type":"string","nullable":true},"infrastructureResourceGroup":{"type":"string","nullable":true},"kind":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"name":{"type":"string"},"provisioningState":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"staticIp":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"workloadProfileCount":{"type":"integer","minimum":0},"workloadProfiles":{"type":"array","items":{"type":"object","properties":{"maximumCount":{"type":"integer","nullable":true},"minimumCount":{"type":"integer","nullable":true},"name":{"type":"string"},"workloadProfileType":{"type":"string"}},"required":["name","workloadProfileType"]}},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","status","workloadProfileCount","workloadProfiles"]},"resourceType":{"type":"string","enum":["azure_container_apps_environment"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"type":"object","properties":{"createdAt":{"type":"string","nullable":true},"disableLocalAuth":{"type":"boolean","nullable":true},"location":{"type":"string","nullable":true},"metricId":{"type":"string","nullable":true},"minimumTlsVersion":{"type":"string","nullable":true},"name":{"type":"string"},"namespaceStatus":{"type":"string","nullable":true},"premiumMessagingPartitions":{"type":"integer","nullable":true},"privateEndpointConnectionCount":{"type":"integer","minimum":0},"provisioningState":{"type":"string","nullable":true},"publicNetworkAccess":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"resourceId":{"type":"string","nullable":true},"serviceBusEndpoint":{"type":"string","nullable":true},"skuCapacity":{"type":"integer","nullable":true},"skuName":{"type":"string","nullable":true},"skuTier":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"updatedAt":{"type":"string","nullable":true},"zoneRedundant":{"type":"boolean","nullable":true}},"required":["name","privateEndpointConnectionCount","status"]},"resourceType":{"type":"string","enum":["azure_service_bus_namespace"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"region":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","region","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["awsBedrock"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"location":{"type":"string"},"project":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["availability","location","project","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpVertex"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"accountName":{"type":"string"},"availability":{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},"endpoint":{"type":"string","nullable":true},"location":{"type":"string","nullable":true},"resourceGroup":{"type":"string","nullable":true},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["accountName","availability","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["azureFoundry"]}},"required":["backend"]}]},{"allOf":[{"type":"object","properties":{"availability":{"oneOf":[{"type":"object","properties":{"catalogRevision":{"type":"string"},"location":{"type":"string","nullable":true},"models":{"type":"array","items":{"type":"object","properties":{"accessTest":{"type":"string","enum":["verified","failed","not-checked"]},"availability":{"type":"string","enum":["available","blocked","unknown"]},"blockers":{"type":"array","items":{"type":"string","enum":["agreement-required","entitlement-required","model-activation-required","deployment-required","quota-configuration-required","region-unavailable","access-denied","observation-failed"]}},"clientApis":{"type":"array","items":{"type":"string","enum":["open-ai-chat-completions","open-ai-responses","anthropic-messages"],"description":"A public API accepted from an application client."}},"errorCode":{"type":"string","nullable":true},"publicModelId":{"type":"string"},"testedAt":{"type":"string","nullable":true,"format":"date-time"}},"required":["accessTest","availability","blockers","clientApis","publicModelId"]}},"source":{"type":"string","enum":["aws-bedrock","gcp-vertex","azure-foundry","anthropic"],"description":"Provider control plane used to observe model availability without invoking\na model, spending customer quota, or accepting provider terms."}},"required":["catalogRevision","models","source"]},{"nullable":true}]},"provider":{"type":"string","description":"The BYO-key provider serving this binding (e.g. \"openai\"). Used on the Local\nplatform, where the app brings its own provider key instead of an ambient cloud."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["provider","status"]},{"type":"object","properties":{"backend":{"type":"string","enum":["external"]}},"required":["backend"]}]}]},"resourceType":{"type":"string","enum":["ai"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean"},"keyArn":{"type":"string"},"keySpec":{"type":"string"},"keyState":{"type":"string"},"keyUsage":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["enabled","keyArn","keySpec","keyState","keyUsage","status"]},"provider":{"type":"string","enum":["aws-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"algorithm":{"type":"string","nullable":true},"cryptoKeyName":{"type":"string"},"primaryState":{"type":"string","nullable":true},"primaryVersion":{"type":"string","nullable":true},"purpose":{"type":"string"},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["cryptoKeyName","purpose","status"]},"provider":{"type":"string","enum":["gcp-cloud-kms"]}},"required":["data","provider"]},{"type":"object","properties":{"data":{"type":"object","properties":{"enabled":{"type":"boolean","nullable":true},"keyId":{"type":"string"},"keyOperations":{"type":"array","items":{"type":"string"}},"keyType":{"type":"string"},"recoveryLevel":{"type":"string","nullable":true},"status":{"type":"object","properties":{"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true}},"required":["health","lifecycle"]}},"required":["keyId","keyOperations","keyType","status"]},"provider":{"type":"string","enum":["azure-key-vault"]}},"required":["data","provider"]}]},"resourceType":{"type":"string","enum":["key"]}},"required":["data","resourceType"]},{"type":"object","properties":{"data":{"oneOf":[{"allOf":[{"type":"object","properties":{"imageIdentifier":{"type":"string","description":"Image the sandboxes belong to."},"imageState":{"type":"string","nullable":true,"description":"The image's own lifecycle state, which is where AWS surfaces base-image deprecation.\n\nNo sandbox count sits beside it: counting means `lambda:ListMicrovms`, which authorizes\nagainst no resource type and so cannot be granted without an account-wide reach the\npermission sets refuse. A field only an over-broad grant could fill is a field whose\nimplementer ships AccessDenied into a customer's account."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["imageIdentifier","status"],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"type":"object","properties":{"backend":{"type":"string","enum":["awsMicrovm"]}},"required":["backend"]}],"description":"AWS: the image a sandbox runs from, and the lifecycle state AWS reports for it."},{"allOf":[{"type":"object","properties":{"provisioningState":{"type":"string","nullable":true},"sandboxGroup":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["sandboxGroup","status"],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"type":"object","properties":{"backend":{"type":"string","enum":["azureSandboxGroup"]}},"required":["backend"]}],"description":"Azure: the sandbox group's ARM state. The data plane has no list operation, so a sandbox count\nis not available here."},{"allOf":[{"type":"object","properties":{"engine":{"type":"string","description":"Reasoning engine the template hangs under, without which the template id names nothing."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]},"templateId":{"type":"string","description":"The template sandboxes are currently cut from."}},"required":["engine","status","templateId"],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"type":"object","properties":{"backend":{"type":"string","enum":["gcpAgentPlatform"]}},"required":["backend"]}],"description":"GCP: the Agent Platform template sandboxes are cut from, and the engine it hangs under.\n\nNo sandbox count: that needs `aiplatform.sandboxEnvironments.list`, which only the management\npermission set holds. No template state either — emission is gated on reading it `ACTIVE`,\nwhich is what `status` already says."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"idlePods":{"type":"integer","minimum":0,"description":"Claimed but unused pods waiting in the pool."},"namespace":{"type":"string"},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","idlePods","namespace","status"],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"type":"object","properties":{"backend":{"type":"string","enum":["kubernetesPods"]}},"required":["backend"]}],"description":"Kubernetes: pods carrying the sandbox label, in the deployment's namespace."},{"allOf":[{"type":"object","properties":{"activeSessions":{"type":"integer","minimum":0},"routeServing":{"type":"boolean","description":"Whether the loopback route is serving in this process. False after a manager restart until\nthe next tick rebinds it."},"status":{"type":"object","properties":{"collectionIssues":{"type":"array","items":{"type":"object","properties":{"message":{"type":"string"},"reason":{"type":"string","enum":["forbidden","not-installed","api-unavailable","collection-failed","timed-out"]},"severity":{"type":"string","enum":["info","warning","error"]},"source":{"type":"string"}},"required":["message","reason","severity","source"]}},"health":{"type":"string","enum":["unknown","healthy","degraded","unhealthy"]},"lifecycle":{"type":"string","enum":["unknown","creating","updating","running","scaling","stopping","stopped","deleting","deleted","failed"]},"message":{"type":"string","nullable":true},"partial":{"type":"boolean"},"stale":{"type":"boolean"}},"required":["collectionIssues","health","lifecycle","partial","stale"]}},"required":["activeSessions","routeServing","status"],"description":"Local: containers Docker still holds for this sandbox."},{"type":"object","properties":{"backend":{"type":"string","enum":["local"]}},"required":["backend"]}],"description":"Local: containers Docker still holds for this sandbox."}],"description":"Content-free telemetry about what a sandbox resource is running.\n\nNever anything from inside a sandbox. A controller reaches only the cloud's management APIs,\nand the whole point of the resource is that the control plane cannot see what runs in it."},"resourceType":{"type":"string","enum":["sandbox"]}},"required":["data","resourceType"]}]},"deploymentId":{"type":"string","nullable":true},"observedAt":{"type":"string","format":"date-time"},"raw":{"type":"array","items":{"type":"object","properties":{"body":{"type":"string"},"collectedAt":{"type":"string","format":"date-time"},"format":{"type":"string","enum":["json","yaml","text"]},"source":{"type":"string"},"truncated":{"type":"boolean"}},"required":["body","collectedAt","format","source","truncated"]}},"resourceId":{"type":"string","description":"Alien resource id, such as the `alien.Container` or `alien.Storage`\nresource id from the stack."},"resourceType":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior."}},"required":["backend","controllerPlatform","data","observedAt","raw","resourceId","resourceType"]},"raw":{"type":"array","items":{"nullable":true}}},"required":["status","deploymentId","resourceId","resourceType","backend","controllerPlatform","observedAt","staleAt","platformStale","heartbeat","raw"]},{"type":"object","properties":{"status":{"type":"string","enum":["missing"]},"deploymentId":{"type":"string"},"resourceId":{"type":"string"},"resourceType":{"type":"string"}},"required":["status","deploymentId","resourceId","resourceType"]}]}},"required":["deployment","heartbeat"]}}}},"404":{"description":"Deployment or resource not found.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys":{"get":{"operationId":"listAwsVirtualKeys","parameters":[{"schema":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"required":true,"description":"Filter by project ID or name.","name":"project","in":"query","examples":{"projectName":{"value":"my-project"},"projectId":{"value":"prj_mcytp6z3j91f7tn5ryqsfwtr"}}}],"responses":{"200":{"description":"AWS Virtual Keys in a project","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKeys":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}},"required":["virtualKeys"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}},"post":{"operationId":"createAwsVirtualKey","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"project":{"$ref":"#/components/schemas/ProjectIDOrNameQueryParam"},"selector":{"oneOf":[{"type":"object","properties":{"externalId":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._~-]*$","description":"Case-sensitive, URL- and header-safe identifier from the integrating application.","example":"ext_example_01"}},"required":["externalId"],"additionalProperties":false},{"type":"object","properties":{"deploymentId":{"type":"string","pattern":"dep_[0-9a-z]{28}$","description":"Unique identifier for the deployment.","example":"dep_0c29fq4a2yjb7kx3smwdgxlc"}},"required":["deploymentId"],"additionalProperties":false}]},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"idempotencyKey":{"type":"string","minLength":1,"maxLength":128},"alias":{"type":"string","nullable":true,"minLength":1,"maxLength":256},"description":{"type":"string","nullable":true,"maxLength":8192},"deletionWindowDays":{"type":"integer","minimum":7,"maximum":30,"default":30},"tags":{"type":"object","additionalProperties":{"type":"string","maxLength":256},"default":{}}},"required":["selector","awsAccountId","awsRegion","idempotencyKey"]}}}},"responses":{"200":{"description":"Created or resumed Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project or Enterprise Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Idempotency conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Gateway unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/rotate-credential":{"post":{"operationId":"rotateAwsVirtualKeyCredential","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"generation":{"type":"integer","minimum":2}},"required":["generation"]}}}},"responses":{"200":{"description":"The resumable XKS proxy credential rotation bundle","content":{"application/json":{"schema":{"type":"object","properties":{"virtualKey":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]},"setup":{"type":"object","properties":{"proxyUriEndpoint":{"type":"string","format":"uri"},"proxyUriPath":{"type":"string"},"accessKeyId":{"type":"string"},"secretAccessKey":{"type":"string"},"externalKeyId":{"type":"string"}},"required":["proxyUriEndpoint","proxyUriPath","accessKeyId","secretAccessKey","externalKeyId"]}},"required":["virtualKey","setup"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot begin rotation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/restore":{"post":{"operationId":"restoreAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key awaiting a successful AWS XKS canary after restore","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key cannot be restored","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/finalize-deletion":{"post":{"operationId":"finalizeAwsVirtualKeyDeletion","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["kmsKeyArn"]}}}},"responses":{"200":{"description":"Virtual Key whose final AWS KMS deletion was observed","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Virtual Key deletion cannot be finalized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/decommission":{"post":{"operationId":"decommissionAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"},"deletionScheduledAt":{"type":"string","format":"date-time"}},"required":["kmsKeyArn","deletionScheduledAt"]}}}},"responses":{"200":{"description":"Virtual Key with AWS deletion scheduled","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"AWS key does not match","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}":{"get":{"operationId":"getAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"responses":{"200":{"description":"AWS Virtual Key","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/aws-virtual-keys/{id}/continue":{"post":{"operationId":"continueAwsVirtualKey","parameters":[{"schema":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"required":true,"description":"Unique identifier for the aws virtual key.","name":"id","in":"path"}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"customKeyStoreId":{"type":"string","pattern":"^cks-[A-Za-z0-9]+$"},"kmsKeyArn":{"type":"string","pattern":"^arn:(?:aws|aws-us-gov):kms:[a-z0-9-]+:\\d{12}:key\\/[A-Za-z0-9-]+$"}},"required":["customKeyStoreId","kmsKeyArn"]}}}},"responses":{"200":{"description":"Updated AWS setup facts","content":{"application/json":{"schema":{"type":"object","properties":{"id":{"type":"string","pattern":"vkey_[0-9a-z]{28}$","description":"Unique identifier for the aws virtual key.","example":"vkey_0p9nwqgtftugsoey99lqyqq"},"projectId":{"type":"string"},"status":{"type":"string","enum":["provisioning","ready","action-required","decommissioning","deletion-pending","deleted","failed"]},"externalKeyId":{"type":"string"},"awsAccountId":{"type":"string","pattern":"^\\d{12}$"},"awsRegion":{"type":"string","pattern":"^[a-z]{2}(?:-gov)?-[a-z]+-\\d$"},"customKeyStoreId":{"type":"string","nullable":true},"kmsKeyArn":{"type":"string","nullable":true},"alias":{"type":"string","nullable":true},"description":{"type":"string","nullable":true},"deletionWindowDays":{"type":"integer"},"tags":{"type":"object","additionalProperties":{"type":"string"}},"observedAt":{"type":"string","nullable":true,"format":"date-time"},"canaryPassedAt":{"type":"string","nullable":true,"format":"date-time"},"deletionScheduledAt":{"type":"string","nullable":true,"format":"date-time"},"finalDeletionObservedAt":{"type":"string","nullable":true,"format":"date-time"},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","projectId","status","externalKeyId","awsAccountId","awsRegion","customKeyStoreId","kmsKeyArn","alias","description","deletionWindowDays","tags","observedAt","canaryPassedAt","deletionScheduledAt","finalDeletionObservedAt","createdAt","updatedAt"]}}}},"400":{"description":"Invalid request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Virtual Key not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"409":{"description":"Setup facts conflict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/resolve":{"get":{"operationId":"resolve","tags":["resolve"],"summary":"Resolve manager for a project and platform","description":"Returns the manager URL for a given project and platform. The project can be provided as a query parameter, or derived from the token's scope (project-scoped, deployment-group-scoped, or deployment-scoped tokens carry an implicit project). This is the single entry point for all CLI tools to discover which manager to talk to.","x-speakeasy-group":"resolve","x-speakeasy-name-override":"resolve","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"string","enum":["aws","gcp","azure","kubernetes","machines","local","test"],"description":"Target platform to resolve the manager for"},"required":true,"description":"Target platform to resolve the manager for","name":"platform","in":"query"},{"schema":{"type":"string","maxLength":100,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope)."},"required":false,"description":"Project ID or name. Required for user and workspace-scoped tokens. Optional for project/deployment-group/deployment-scoped tokens (derived from token scope).","name":"project","in":"query"}],"responses":{"200":{"description":"Manager resolved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResolveResponse"}}}},"400":{"description":"Missing required project parameter for this token type.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"404":{"description":"Project not found or no manager available for platform.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"503":{"description":"Manager not ready yet (no URL reported). Retry after a delay.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/cloud-regions":{"get":{"operationId":"getCloudRegions","description":"Get cloud regions supported by this Alien environment.","x-speakeasy-group":"cloudRegions","x-speakeasy-name-override":"get","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Supported cloud regions retrieved successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CloudRegionsResponse"}}}}}}},"/v1/billing/audit-log":{"get":{"operationId":"listBillingAuditLog","description":"List billing activity entries for the current workspace.","x-speakeasy-group":"billing","x-speakeasy-name-override":"listAuditLog","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"},{"schema":{"type":"number","minimum":1,"maximum":200,"default":50},"required":false,"name":"limit","in":"query"},{"schema":{"type":"string","description":"Cursor: id from the previous page."},"required":false,"description":"Cursor: id from the previous page.","name":"before","in":"query"}],"responses":{"200":{"description":"Audit-log rows newest-first.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/BillingAuditLogRow"}},"nextCursor":{"type":"string","nullable":true}},"required":["items","nextCursor"]}}}}}}},"/v1/billing/entitlements":{"get":{"operationId":"getWorkspaceBillingEntitlements","description":"Get the workspace billing entitlements used for product feature gates. Autumn is the source of truth; the response is served through the workspace billing read model with stale-cache fallback.","x-speakeasy-group":"billing","x-speakeasy-name-override":"getEntitlements","parameters":[{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace billing entitlements.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceBillingEntitlements"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}},"/v1/gateways/{gateway}/overview":{"get":{"operationId":"getWorkspaceGatewayOverview","description":"Get compact cross-Project setup and customer status for a workspace Gateway.","x-speakeasy-group":"gateways","x-speakeasy-name-override":"getWorkspaceOverview","parameters":[{"schema":{"$ref":"#/components/schemas/GatewayKind"},"required":true,"description":"Alien Gateway a customer deployment runs","name":"gateway","in":"path"},{"schema":{"type":"string","minLength":4,"maxLength":100,"pattern":"^(?!ws[-_])[a-z0-9](-?[a-z0-9])*$","description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","example":"my-workspace"},"required":false,"description":"Workspace name. Required for user/session/OAuth requests. Optional for API keys because API keys are workspace-scoped; if provided with an API key, it must match the key's workspace.","name":"workspace","in":"query"}],"responses":{"200":{"description":"Workspace Gateway overview.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceGatewayOverview"}}}},"403":{"description":"Insufficient permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/APIError"}}}}}}}}}
diff --git a/crates/alien-aws-clients/src/aws/dlm.rs b/crates/alien-aws-clients/src/aws/dlm.rs
new file mode 100644
index 0000000000..56ac65e34c
--- /dev/null
+++ b/crates/alien-aws-clients/src/aws/dlm.rs
@@ -0,0 +1,781 @@
+//! Amazon Data Lifecycle Manager client.
+//!
+//! Covers the lifecycle-policy operations needed to keep a scheduled EBS
+//! snapshot policy in sync with a desired schedule. DLM is a REST/JSON API:
+//! https://docs.aws.amazon.com/dlm/latest/APIReference/
+
+use crate::aws::aws_request_utils::{AwsRequestBuilderExt, AwsSignConfig};
+use crate::aws::credential_provider::AwsCredentialProvider;
+use alien_client_core::{ErrorData, Result};
+use alien_error::{Context, ContextError, IntoAlienError};
+use async_trait::async_trait;
+use bon::Builder;
+use reqwest::{Client, Method, StatusCode};
+use serde::{de::DeserializeOwned, Deserialize, Serialize};
+use std::{collections::HashMap, fmt::Debug};
+
+#[cfg(feature = "test-utils")]
+use mockall::automock;
+
+#[cfg_attr(feature = "test-utils", automock)]
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait DlmApi: Send + Sync + Debug {
+    /// Creates a lifecycle policy. Sent once: DLM has no idempotency token, so a
+    /// retried create after a lost response could create a second policy.
+    async fn create_lifecycle_policy(
+        &self,
+        request: CreateLifecyclePolicyRequest,
+    ) -> Result<CreateLifecyclePolicyResponse>;
+    async fn get_lifecycle_policy(&self, policy_id: &str) -> Result<GetLifecyclePolicyResponse>;
+    /// Lists policy summaries, optionally filtered by target tags (`key=value`).
+    async fn get_lifecycle_policies(
+        &self,
+        request: GetLifecyclePoliciesRequest,
+    ) -> Result<GetLifecyclePoliciesResponse>;
+    async fn update_lifecycle_policy(
+        &self,
+        policy_id: &str,
+        request: UpdateLifecyclePolicyRequest,
+    ) -> Result<()>;
+    async fn delete_lifecycle_policy(&self, policy_id: &str) -> Result<()>;
+}
+
+#[derive(Debug, Clone)]
+pub struct DlmClient {
+    client: Client,
+    credentials: AwsCredentialProvider,
+}
+
+#[derive(Clone, Copy)]
+enum Attempts {
+    Retried,
+    Once,
+}
+
+impl DlmClient {
+    pub fn new(client: Client, credentials: AwsCredentialProvider) -> Self {
+        Self {
+            client,
+            credentials,
+        }
+    }
+
+    fn sign_config(&self) -> AwsSignConfig {
+        AwsSignConfig {
+            service_name: "dlm".into(),
+            region: self.credentials.region().to_string(),
+            credentials: self.credentials.get_credentials(),
+            signing_region: None,
+        }
+    }
+
+    fn get_base_url(&self) -> String {
+        if let Some(override_url) = self.credentials.get_service_endpoint_option("dlm") {
+            override_url.to_string()
+        } else {
+            format!("https://dlm.{}.amazonaws.com", self.credentials.region())
+        }
+    }
+
+    fn request(&self, method: Method, path_and_query: &str) -> reqwest::RequestBuilder {
+        let url = format!(
+            "{}{}",
+            self.get_base_url().trim_end_matches('/'),
+            path_and_query
+        );
+        self.client
+            .request(method, &url)
+            .host(&format!("dlm.{}.amazonaws.com", self.credentials.region()))
+    }
+
+    async fn send_json<T: DeserializeOwned + Send + 'static>(
+        &self,
+        attempts: Attempts,
+        method: Method,
+        path_and_query: &str,
+        body: Option<String>,
+        operation: &str,
+        resource_name: &str,
+    ) -> Result<T> {
+        self.credentials.ensure_fresh().await?;
+        let mut builder = self.request(method, path_and_query);
+        if let Some(body) = body {
+            builder = builder
+                .header("Content-Type", "application/json")
+                .content_sha256(&body)
+                .body(body);
+        }
+        let result = match attempts {
+            Attempts::Retried => {
+                crate::aws::aws_request_utils::sign_send_json(builder, &self.sign_config()).await
+            }
+            Attempts::Once => {
+                crate::aws::aws_request_utils::sign_send_json_once(builder, &self.sign_config())
+                    .await
+            }
+        };
+        Self::map_result(result, operation, resource_name)
+    }
+
+    async fn send_no_response(
+        &self,
+        method: Method,
+        path: &str,
+        body: Option<String>,
+        operation: &str,
+        resource_name: &str,
+    ) -> Result<()> {
+        self.credentials.ensure_fresh().await?;
+        let mut builder = self.request(method, path);
+        if let Some(body) = body {
+            builder = builder
+                .header("Content-Type", "application/json")
+                .content_sha256(&body)
+                .body(body);
+        }
+        let result =
+            crate::aws::aws_request_utils::sign_send_no_response(builder, &self.sign_config())
+                .await;
+        Self::map_result(result, operation, resource_name)
+    }
+
+    fn map_result<T>(result: Result<T>, operation: &str, resource_name: &str) -> Result<T> {
+        let error = match result {
+            Ok(value) => return Ok(value),
+            Err(error) => error,
+        };
+        let Some(ErrorData::HttpResponseError {
+            http_status,
+            http_response_text,
+            ..
+        }) = &error.error
+        else {
+            return Err(error);
+        };
+        let status =
+            StatusCode::from_u16(*http_status).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+        let mapped = map_dlm_error(
+            status,
+            http_response_text.as_deref().unwrap_or_default(),
+            operation,
+            resource_name,
+        );
+        Err(error.context(mapped))
+    }
+
+    fn serialize<T: Serialize>(value: &T, operation: &str) -> Result<String> {
+        serde_json::to_string(value)
+            .into_alien_error()
+            .context(ErrorData::SerializationError {
+                message: format!("Failed to serialize DLM {operation} request"),
+            })
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl DlmApi for DlmClient {
+    async fn create_lifecycle_policy(
+        &self,
+        request: CreateLifecyclePolicyRequest,
+    ) -> Result<CreateLifecyclePolicyResponse> {
+        let body = Self::serialize(&request, "CreateLifecyclePolicy")?;
+        self.send_json(
+            Attempts::Once,
+            Method::POST,
+            "/policies",
+            Some(body),
+            "CreateLifecyclePolicy",
+            &request.description,
+        )
+        .await
+    }
+
+    async fn get_lifecycle_policy(&self, policy_id: &str) -> Result<GetLifecyclePolicyResponse> {
+        self.send_json(
+            Attempts::Retried,
+            Method::GET,
+            &format!("/policies/{}", urlencoding::encode(policy_id)),
+            None,
+            "GetLifecyclePolicy",
+            policy_id,
+        )
+        .await
+    }
+
+    async fn get_lifecycle_policies(
+        &self,
+        request: GetLifecyclePoliciesRequest,
+    ) -> Result<GetLifecyclePoliciesResponse> {
+        let path = format!("/policies{}", request.query_string());
+        self.send_json(
+            Attempts::Retried,
+            Method::GET,
+            &path,
+            None,
+            "GetLifecyclePolicies",
+            "lifecycle policies",
+        )
+        .await
+    }
+
+    async fn update_lifecycle_policy(
+        &self,
+        policy_id: &str,
+        request: UpdateLifecyclePolicyRequest,
+    ) -> Result<()> {
+        let body = Self::serialize(&request, "UpdateLifecyclePolicy")?;
+        self.send_no_response(
+            Method::PATCH,
+            &format!("/policies/{}", urlencoding::encode(policy_id)),
+            Some(body),
+            "UpdateLifecyclePolicy",
+            policy_id,
+        )
+        .await
+    }
+
+    async fn delete_lifecycle_policy(&self, policy_id: &str) -> Result<()> {
+        self.send_no_response(
+            Method::DELETE,
+            &format!("/policies/{}", urlencoding::encode(policy_id)),
+            None,
+            "DeleteLifecyclePolicy",
+            policy_id,
+        )
+        .await
+    }
+}
+
+/// DLM error body. The error type arrives in `x-amzn-ErrorType` and, for most
+/// errors, in the body as `Code`/`code`.
+#[derive(Debug, Deserialize)]
+struct DlmErrorBody {
+    #[serde(alias = "Message")]
+    message: Option<String>,
+    #[serde(alias = "Code", alias = "__type")]
+    code: Option<String>,
+}
+
+fn map_dlm_error(status: StatusCode, body: &str, operation: &str, resource: &str) -> ErrorData {
+    let parsed = serde_json::from_str::<DlmErrorBody>(body).ok();
+    let code = parsed
+        .as_ref()
+        .and_then(|error| error.code.clone())
+        .unwrap_or_default();
+    let message = parsed
+        .and_then(|error| error.message)
+        .unwrap_or_else(|| format!("DLM {operation} failed with HTTP {status}"));
+    let message = if code.is_empty() {
+        message
+    } else {
+        format!("{code}: {message}")
+    };
+    match status {
+        StatusCode::NOT_FOUND => ErrorData::RemoteResourceNotFound {
+            resource_type: "DLM lifecycle policy".to_string(),
+            resource_name: resource.to_string(),
+        },
+        StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN => ErrorData::RemoteAccessDenied {
+            resource_type: "DLM lifecycle policy".to_string(),
+            resource_name: resource.to_string(),
+        },
+        StatusCode::TOO_MANY_REQUESTS => ErrorData::RateLimitExceeded { message },
+        StatusCode::BAD_REQUEST => ErrorData::InvalidInput {
+            message,
+            field_name: None,
+        },
+        _ => ErrorData::RemoteServiceUnavailable {
+            message: format!("DLM {operation} failed for '{resource}': {message}"),
+        },
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+/// A DLM tag (`Key`/`Value`), used for target tags and tags added to snapshots.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Builder)]
+#[serde(rename_all = "PascalCase")]
+pub struct DlmTag {
+    pub key: String,
+    pub value: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Builder, Default)]
+#[serde(rename_all = "PascalCase")]
+pub struct PolicyDetails {
+    /// `EBS_SNAPSHOT_MANAGEMENT`, `IMAGE_MANAGEMENT` or `EVENT_BASED_POLICY`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy_type: Option<String>,
+    /// `VOLUME` or `INSTANCE`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resource_types: Option<Vec<String>>,
+    /// `CLOUD`, `OUTPOST` or `LOCAL_ZONE`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resource_locations: Option<Vec<String>>,
+    /// Resources with ANY of these tags are targeted.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub target_tags: Option<Vec<DlmTag>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub schedules: Option<Vec<Schedule>>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Builder, Default)]
+#[serde(rename_all = "PascalCase")]
+pub struct Schedule {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Copy the source volume's tags onto each snapshot.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub copy_tags: Option<bool>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tags_to_add: Option<Vec<DlmTag>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub create_rule: Option<CreateRule>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub retain_rule: Option<RetainRule>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Builder, Default)]
+#[serde(rename_all = "PascalCase")]
+pub struct CreateRule {
+    /// For `HOURS`: 1, 2, 3, 4, 6, 8, 12 or 24.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub interval: Option<i32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub interval_unit: Option<String>,
+    /// Start time in UTC, `hh:mm`. DLM accepts one value.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub times: Option<Vec<String>>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cron_expression: Option<String>,
+}
+
+/// Count-based (`count`) or age-based (`interval` + `interval_unit`) retention.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Builder, Default)]
+#[serde(rename_all = "PascalCase")]
+pub struct RetainRule {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub count: Option<i32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub interval: Option<i32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub interval_unit: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Builder)]
+#[serde(rename_all = "PascalCase")]
+pub struct CreateLifecyclePolicyRequest {
+    /// Allowed characters: `[0-9A-Za-z _-]`, at most 500.
+    pub description: String,
+    pub execution_role_arn: String,
+    /// `ENABLED` or `DISABLED`.
+    pub state: String,
+    pub policy_details: PolicyDetails,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tags: Option<HashMap<String, String>>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct CreateLifecyclePolicyResponse {
+    pub policy_id: String,
+}
+
+#[derive(Debug, Clone, Serialize, Builder, Default)]
+#[serde(rename_all = "PascalCase")]
+pub struct UpdateLifecyclePolicyRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub execution_role_arn: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub state: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub policy_details: Option<PolicyDetails>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct GetLifecyclePolicyResponse {
+    pub policy: LifecyclePolicy,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct LifecyclePolicy {
+    pub policy_id: String,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub state: Option<String>,
+    #[serde(default)]
+    pub status_message: Option<String>,
+    #[serde(default)]
+    pub execution_role_arn: Option<String>,
+    #[serde(default)]
+    pub policy_arn: Option<String>,
+    #[serde(default)]
+    pub policy_details: Option<PolicyDetails>,
+    #[serde(default)]
+    pub tags: Option<HashMap<String, String>>,
+}
+
+/// Filters for `GetLifecyclePolicies`. Tag filters use `key=value` strings.
+#[derive(Debug, Clone, Builder, Default)]
+pub struct GetLifecyclePoliciesRequest {
+    pub policy_ids: Option<Vec<String>>,
+    /// `ENABLED`, `DISABLED` or `ERROR`.
+    pub state: Option<String>,
+    pub resource_types: Option<Vec<String>>,
+    pub target_tags: Option<Vec<String>>,
+    pub tags_to_add: Option<Vec<String>>,
+}
+
+impl GetLifecyclePoliciesRequest {
+    /// Lists are sent as repeated query parameters, as the REST/JSON protocol does.
+    fn query_string(&self) -> String {
+        let mut query = form_urlencoded::Serializer::new(String::new());
+        for (name, values) in [
+            ("policyIds", &self.policy_ids),
+            ("resourceTypes", &self.resource_types),
+            ("targetTags", &self.target_tags),
+            ("tagsToAdd", &self.tags_to_add),
+        ] {
+            for value in values.iter().flatten() {
+                query.append_pair(name, value);
+            }
+        }
+        if let Some(state) = &self.state {
+            query.append_pair("state", state);
+        }
+        let query = query.finish();
+        if query.is_empty() {
+            String::new()
+        } else {
+            format!("?{query}")
+        }
+    }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct GetLifecyclePoliciesResponse {
+    #[serde(default)]
+    pub policies: Vec<LifecyclePolicySummary>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "PascalCase")]
+pub struct LifecyclePolicySummary {
+    pub policy_id: String,
+    #[serde(default)]
+    pub description: Option<String>,
+    #[serde(default)]
+    pub state: Option<String>,
+    #[serde(default)]
+    pub policy_type: Option<String>,
+    #[serde(default)]
+    pub tags: Option<HashMap<String, String>>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::ServiceOverrides;
+    use alien_core::{AwsClientConfig, AwsCredentials};
+    use httpmock::prelude::*;
+
+    fn client(server: &MockServer) -> DlmClient {
+        let config = AwsClientConfig {
+            account_id: "123456789012".to_string(),
+            region: "us-east-1".to_string(),
+            credentials: AwsCredentials::AccessKeys {
+                access_key_id: "test-access-key".to_string(),
+                secret_access_key: "test-secret-key".to_string(),
+                session_token: None,
+            },
+            service_overrides: Some(ServiceOverrides {
+                endpoints: HashMap::from([("dlm".to_string(), server.base_url())]),
+            }),
+        };
+        DlmClient::new(
+            reqwest::Client::new(),
+            AwsCredentialProvider::from_config_sync(config),
+        )
+    }
+
+    fn snapshot_policy_details() -> PolicyDetails {
+        PolicyDetails::builder()
+            .policy_type("EBS_SNAPSHOT_MANAGEMENT".to_string())
+            .resource_types(vec!["VOLUME".to_string()])
+            .target_tags(vec![DlmTag::builder()
+                .key("alien-backup-policy".to_string())
+                .value("stack-db".to_string())
+                .build()])
+            .schedules(vec![Schedule::builder()
+                .name("every-4h".to_string())
+                .copy_tags(true)
+                .tags_to_add(vec![DlmTag::builder()
+                    .key("alien-snapshot-kind".to_string())
+                    .value("scheduled".to_string())
+                    .build()])
+                .create_rule(
+                    CreateRule::builder()
+                        .interval(4)
+                        .interval_unit("HOURS".to_string())
+                        .times(vec!["00:00".to_string()])
+                        .build(),
+                )
+                .retain_rule(
+                    RetainRule::builder()
+                        .interval(7)
+                        .interval_unit("DAYS".to_string())
+                        .build(),
+                )
+                .build()])
+            .build()
+    }
+
+    #[tokio::test]
+    async fn create_posts_the_documented_body_once_and_returns_the_policy_id() {
+        let server = MockServer::start_async().await;
+        let create = server
+            .mock_async(|when, then| {
+                when.method(POST)
+                    .path("/policies")
+                    .header_exists("authorization")
+                    .json_body(serde_json::json!({
+                        "Description": "stack db volume backups",
+                        "ExecutionRoleArn": "arn:aws:iam::123456789012:role/stack-db-dlm",
+                        "State": "ENABLED",
+                        "PolicyDetails": {
+                            "PolicyType": "EBS_SNAPSHOT_MANAGEMENT",
+                            "ResourceTypes": ["VOLUME"],
+                            "TargetTags": [{"Key": "alien-backup-policy", "Value": "stack-db"}],
+                            "Schedules": [{
+                                "Name": "every-4h",
+                                "CopyTags": true,
+                                "TagsToAdd": [{"Key": "alien-snapshot-kind", "Value": "scheduled"}],
+                                "CreateRule": {"Interval": 4, "IntervalUnit": "HOURS", "Times": ["00:00"]},
+                                "RetainRule": {"Interval": 7, "IntervalUnit": "DAYS"}
+                            }]
+                        },
+                        "Tags": {"alien-stack": "stack"}
+                    }));
+                then.status(200)
+                    .json_body(serde_json::json!({"PolicyId": "policy-0abc"}));
+            })
+            .await;
+
+        let response = client(&server)
+            .create_lifecycle_policy(
+                CreateLifecyclePolicyRequest::builder()
+                    .description("stack db volume backups".to_string())
+                    .execution_role_arn("arn:aws:iam::123456789012:role/stack-db-dlm".to_string())
+                    .state("ENABLED".to_string())
+                    .policy_details(snapshot_policy_details())
+                    .tags(HashMap::from([(
+                        "alien-stack".to_string(),
+                        "stack".to_string(),
+                    )]))
+                    .build(),
+            )
+            .await
+            .expect("create should succeed");
+
+        assert_eq!(response.policy_id, "policy-0abc");
+        assert_eq!(create.hits_async().await, 1);
+    }
+
+    #[tokio::test]
+    async fn a_rejected_create_is_not_retried_and_keeps_the_service_message() {
+        let server = MockServer::start_async().await;
+        let create = server
+            .mock_async(|when, then| {
+                when.method(POST).path("/policies");
+                then.status(400)
+                    .header("x-amzn-ErrorType", "InvalidRequestException")
+                    .json_body(serde_json::json!({
+                        "Code": "InvalidRequestException",
+                        "Message": "Provided role arn:aws:iam::123456789012:role/stack-db-dlm cannot be assumed by principal 'dlm.amazonaws.com'."
+                    }));
+            })
+            .await;
+
+        let error = client(&server)
+            .create_lifecycle_policy(
+                CreateLifecyclePolicyRequest::builder()
+                    .description("stack db volume backups".to_string())
+                    .execution_role_arn("arn:aws:iam::123456789012:role/stack-db-dlm".to_string())
+                    .state("ENABLED".to_string())
+                    .policy_details(snapshot_policy_details())
+                    .build(),
+            )
+            .await
+            .expect_err("an unassumable role is rejected");
+
+        assert_eq!(create.hits_async().await, 1);
+        assert_eq!(error.code, "INVALID_INPUT");
+        match error.error {
+            Some(ErrorData::InvalidInput { message, .. }) => {
+                assert!(message.contains("cannot be assumed"), "{message}");
+                assert!(message.starts_with("InvalidRequestException"), "{message}");
+            }
+            other => panic!("unexpected error data: {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn get_policies_sends_target_tags_as_repeated_query_parameters() {
+        let server = MockServer::start_async().await;
+        let list = server
+            .mock_async(|when, then| {
+                when.method(GET)
+                    .path("/policies")
+                    .query_param("targetTags", "alien-backup-policy=stack-db")
+                    .query_param("resourceTypes", "VOLUME");
+                then.status(200).json_body(serde_json::json!({
+                    "Policies": [{
+                        "PolicyId": "policy-0abc",
+                        "Description": "stack db volume backups",
+                        "State": "ENABLED",
+                        "PolicyType": "EBS_SNAPSHOT_MANAGEMENT",
+                        "Tags": {"alien-stack": "stack"},
+                        "DefaultPolicy": false
+                    }]
+                }));
+            })
+            .await;
+
+        let response = client(&server)
+            .get_lifecycle_policies(
+                GetLifecyclePoliciesRequest::builder()
+                    .target_tags(vec!["alien-backup-policy=stack-db".to_string()])
+                    .resource_types(vec!["VOLUME".to_string()])
+                    .build(),
+            )
+            .await
+            .expect("list should succeed");
+
+        assert_eq!(list.hits_async().await, 1);
+        assert_eq!(response.policies.len(), 1);
+        assert_eq!(response.policies[0].policy_id, "policy-0abc");
+        assert_eq!(
+            response.policies[0]
+                .tags
+                .as_ref()
+                .and_then(|tags| tags.get("alien-stack"))
+                .map(String::as_str),
+            Some("stack")
+        );
+    }
+
+    #[tokio::test]
+    async fn get_policy_reads_the_schedule_back() {
+        let server = MockServer::start_async().await;
+        server
+            .mock_async(|when, then| {
+                when.method(GET).path("/policies/policy-0abc");
+                then.status(200).json_body(serde_json::json!({
+                    "Policy": {
+                        "PolicyId": "policy-0abc",
+                        "Description": "stack db volume backups",
+                        "State": "ENABLED",
+                        "StatusMessage": "ENABLED",
+                        "ExecutionRoleArn": "arn:aws:iam::123456789012:role/stack-db-dlm",
+                        "DateCreated": "2026-10-05T12:00:00.000Z",
+                        "DateModified": "2026-10-05T12:00:00.000Z",
+                        "PolicyArn": "arn:aws:dlm:us-east-1:123456789012:policy/policy-0abc",
+                        "DefaultPolicy": false,
+                        "PolicyDetails": {
+                            "PolicyType": "EBS_SNAPSHOT_MANAGEMENT",
+                            "PolicyLanguage": "STANDARD",
+                            "ResourceTypes": ["VOLUME"],
+                            "ResourceLocations": ["CLOUD"],
+                            "TargetTags": [{"Key": "alien-backup-policy", "Value": "stack-db"}],
+                            "Schedules": [{
+                                "Name": "every-4h",
+                                "CopyTags": true,
+                                "TagsToAdd": [{"Key": "alien-snapshot-kind", "Value": "scheduled"}],
+                                "CreateRule": {"Interval": 4, "IntervalUnit": "HOURS", "Times": ["00:00"], "Location": "CLOUD"},
+                                "RetainRule": {"Interval": 7, "IntervalUnit": "DAYS"}
+                            }]
+                        },
+                        "Tags": {"alien-stack": "stack"}
+                    }
+                }));
+            })
+            .await;
+
+        let policy = client(&server)
+            .get_lifecycle_policy("policy-0abc")
+            .await
+            .expect("get should succeed")
+            .policy;
+
+        let details = policy.policy_details.expect("policy details");
+        let schedule = &details.schedules.expect("schedules")[0];
+        assert_eq!(
+            schedule.create_rule.as_ref().and_then(|rule| rule.interval),
+            Some(4)
+        );
+        assert_eq!(
+            schedule.retain_rule,
+            Some(
+                RetainRule::builder()
+                    .interval(7)
+                    .interval_unit("DAYS".to_string())
+                    .build()
+            )
+        );
+        assert_eq!(
+            policy.execution_role_arn.as_deref(),
+            Some("arn:aws:iam::123456789012:role/stack-db-dlm")
+        );
+    }
+
+    #[tokio::test]
+    async fn update_patches_and_delete_maps_a_missing_policy_to_not_found() {
+        let server = MockServer::start_async().await;
+        let update = server
+            .mock_async(|when, then| {
+                when.method(httpmock::Method::PATCH)
+                    .path("/policies/policy-0abc")
+                    .json_body(serde_json::json!({"State": "ENABLED"}));
+                then.status(200);
+            })
+            .await;
+        server
+            .mock_async(|when, then| {
+                when.method(DELETE).path("/policies/policy-gone");
+                then.status(404).json_body(serde_json::json!({
+                    "Code": "ResourceNotFoundException",
+                    "Message": "Lifecycle policy not found",
+                    "ResourceType": "LifecyclePolicy",
+                    "ResourceIds": ["policy-gone"]
+                }));
+            })
+            .await;
+        let dlm = client(&server);
+
+        dlm.update_lifecycle_policy(
+            "policy-0abc",
+            UpdateLifecyclePolicyRequest::builder()
+                .state("ENABLED".to_string())
+                .build(),
+        )
+        .await
+        .expect("update should succeed");
+        let error = dlm
+            .delete_lifecycle_policy("policy-gone")
+            .await
+            .expect_err("missing policy");
+
+        assert_eq!(update.hits_async().await, 1);
+        assert_eq!(error.code, "REMOTE_RESOURCE_NOT_FOUND");
+    }
+}
diff --git a/crates/alien-aws-clients/src/aws/ec2.rs b/crates/alien-aws-clients/src/aws/ec2.rs
index 54d067e6ee..0e32dd8858 100644
--- a/crates/alien-aws-clients/src/aws/ec2.rs
+++ b/crates/alien-aws-clients/src/aws/ec2.rs
@@ -209,6 +209,20 @@ pub trait Ec2Api: Send + Sync + std::fmt::Debug {
     async fn attach_volume(&self, request: AttachVolumeRequest) -> Result<AttachVolumeResponse>;
     async fn detach_volume(&self, request: DetachVolumeRequest) -> Result<DetachVolumeResponse>;
 
+    // Snapshot Operations
+    /// Starts a snapshot of a volume. EC2 offers no idempotency token for this call:
+    /// callers that must not create duplicates look for an existing tagged snapshot first.
+    async fn create_snapshot(&self, request: CreateSnapshotRequest) -> Result<Snapshot>;
+    async fn describe_snapshots(
+        &self,
+        request: DescribeSnapshotsRequest,
+    ) -> Result<DescribeSnapshotsResponse>;
+    async fn delete_snapshot(&self, snapshot_id: &str) -> Result<()>;
+
+    // Tag Operations
+    async fn create_tags(&self, request: CreateTagsRequest) -> Result<()>;
+    async fn delete_tags(&self, request: DeleteTagsRequest) -> Result<()>;
+
     // Launch Template Operations
     async fn create_launch_template(
         &self,
@@ -503,6 +517,19 @@ impl Ec2Client {
                 resource_type: "SecurityGroupRule".into(),
                 resource_name: resource.into(),
             },
+            "InvalidSnapshot.NotFound" | "InvalidSnapshotID.NotFound" => {
+                ErrorData::RemoteResourceNotFound {
+                    resource_type: "Snapshot".into(),
+                    resource_name: resource.into(),
+                }
+            }
+            // A snapshot still used by a registered image.
+            "InvalidSnapshot.InUse" => ErrorData::RemoteResourceConflict {
+                message,
+                resource_type: "Snapshot".into(),
+                resource_name: resource.into(),
+            },
+            "SnapshotCreationPerVolumeRateExceeded" => ErrorData::RateLimitExceeded { message },
             "InvalidVolume.NotFound" | "InvalidVolumeID.NotFound" => {
                 ErrorData::RemoteResourceNotFound {
                     resource_type: "Volume".into(),
@@ -664,6 +691,69 @@ impl Ec2Client {
         form_data
     }
 
+    fn create_snapshot_form_data(request: &CreateSnapshotRequest) -> HashMap<String, String> {
+        let mut form_data = HashMap::new();
+        form_data.insert("Action".to_string(), "CreateSnapshot".to_string());
+        form_data.insert("Version".to_string(), "2016-11-15".to_string());
+        form_data.insert("VolumeId".to_string(), request.volume_id.clone());
+        if let Some(description) = &request.description {
+            form_data.insert("Description".to_string(), description.clone());
+        }
+        if let Some(tag_specs) = &request.tag_specifications {
+            Self::add_tag_specifications(&mut form_data, tag_specs);
+        }
+        form_data
+    }
+
+    fn describe_snapshots_form_data(request: &DescribeSnapshotsRequest) -> HashMap<String, String> {
+        let mut form_data = HashMap::new();
+        form_data.insert("Action".to_string(), "DescribeSnapshots".to_string());
+        form_data.insert("Version".to_string(), "2016-11-15".to_string());
+        for (i, snapshot_id) in request.snapshot_ids.iter().flatten().enumerate() {
+            form_data.insert(format!("SnapshotId.{}", i + 1), snapshot_id.clone());
+        }
+        for (i, owner) in request.owner_ids.iter().flatten().enumerate() {
+            form_data.insert(format!("Owner.{}", i + 1), owner.clone());
+        }
+        if let Some(filters) = &request.filters {
+            Self::add_filters(&mut form_data, filters);
+        }
+        if let Some(max_results) = request.max_results {
+            form_data.insert("MaxResults".to_string(), max_results.to_string());
+        }
+        if let Some(next_token) = &request.next_token {
+            form_data.insert("NextToken".to_string(), next_token.clone());
+        }
+        form_data
+    }
+
+    fn create_tags_form_data(request: &CreateTagsRequest) -> HashMap<String, String> {
+        let mut form_data = HashMap::new();
+        form_data.insert("Action".to_string(), "CreateTags".to_string());
+        form_data.insert("Version".to_string(), "2016-11-15".to_string());
+        for (i, resource_id) in request.resource_ids.iter().enumerate() {
+            form_data.insert(format!("ResourceId.{}", i + 1), resource_id.clone());
+        }
+        for (i, tag) in request.tags.iter().enumerate() {
+            form_data.insert(format!("Tag.{}.Key", i + 1), tag.key.clone());
+            form_data.insert(format!("Tag.{}.Value", i + 1), tag.value.clone());
+        }
+        form_data
+    }
+
+    fn delete_tags_form_data(request: &DeleteTagsRequest) -> HashMap<String, String> {
+        let mut form_data = HashMap::new();
+        form_data.insert("Action".to_string(), "DeleteTags".to_string());
+        form_data.insert("Version".to_string(), "2016-11-15".to_string());
+        for (i, resource_id) in request.resource_ids.iter().enumerate() {
+            form_data.insert(format!("ResourceId.{}", i + 1), resource_id.clone());
+        }
+        for (i, key) in request.tag_keys.iter().enumerate() {
+            form_data.insert(format!("Tag.{}.Key", i + 1), key.clone());
+        }
+        form_data
+    }
+
     fn modify_volume_form_data(request: &ModifyVolumeRequest) -> HashMap<String, String> {
         let mut form_data = HashMap::new();
         form_data.insert("Action".to_string(), "ModifyVolume".to_string());
@@ -1698,6 +1788,52 @@ impl Ec2Api for Ec2Client {
             .await
     }
 
+    // ---------------------------------------------------------------------------
+    // Snapshot Operations
+    // ---------------------------------------------------------------------------
+
+    async fn create_snapshot(&self, request: CreateSnapshotRequest) -> Result<Snapshot> {
+        let form_data = Self::create_snapshot_form_data(&request);
+        self.send_form(form_data, "CreateSnapshot", &request.volume_id)
+            .await
+    }
+
+    async fn describe_snapshots(
+        &self,
+        request: DescribeSnapshotsRequest,
+    ) -> Result<DescribeSnapshotsResponse> {
+        let form_data = Self::describe_snapshots_form_data(&request);
+        self.send_form(form_data, "DescribeSnapshots", "Snapshot")
+            .await
+    }
+
+    async fn delete_snapshot(&self, snapshot_id: &str) -> Result<()> {
+        let mut form_data = HashMap::new();
+        form_data.insert("Action".to_string(), "DeleteSnapshot".to_string());
+        form_data.insert("Version".to_string(), "2016-11-15".to_string());
+        form_data.insert("SnapshotId".to_string(), snapshot_id.to_string());
+        self.send_form_no_body(form_data, "DeleteSnapshot", snapshot_id)
+            .await
+    }
+
+    // ---------------------------------------------------------------------------
+    // Tag Operations
+    // ---------------------------------------------------------------------------
+
+    async fn create_tags(&self, request: CreateTagsRequest) -> Result<()> {
+        let form_data = Self::create_tags_form_data(&request);
+        let resource = request.resource_ids.join(",");
+        self.send_form_no_body(form_data, "CreateTags", &resource)
+            .await
+    }
+
+    async fn delete_tags(&self, request: DeleteTagsRequest) -> Result<()> {
+        let form_data = Self::delete_tags_form_data(&request);
+        let resource = request.resource_ids.join(",");
+        self.send_form_no_body(form_data, "DeleteTags", &resource)
+            .await
+    }
+
     // ---------------------------------------------------------------------------
     // Launch Template Operations
     // ---------------------------------------------------------------------------
@@ -3539,11 +3675,99 @@ pub struct VolumeAttachment {
     pub volume_id: Option<String>,
     pub instance_id: Option<String>,
     pub device: Option<String>,
+    /// `attaching`, `attached`, `detaching`, `detached` or `busy`. EC2 names it `status`.
+    #[serde(rename = "status")]
     pub state: Option<String>,
     pub attach_time: Option<String>,
     pub delete_on_termination: Option<bool>,
 }
 
+// ---------------------------------------------------------------------------
+// Snapshot and Tag Request/Response Types
+// ---------------------------------------------------------------------------
+
+/// Request to snapshot a volume.
+#[derive(Debug, Clone, Serialize, Builder)]
+pub struct CreateSnapshotRequest {
+    pub volume_id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+    /// Tags for the snapshot (resource type `snapshot`).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tag_specifications: Option<Vec<TagSpecification>>,
+}
+
+/// Request to describe snapshots.
+///
+/// Pass `owner_ids: ["self"]` to list only this account's snapshots. EC2 rejects
+/// `max_results` together with `snapshot_ids`.
+#[derive(Debug, Clone, Serialize, Builder, Default)]
+pub struct DescribeSnapshotsRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snapshot_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub owner_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub filters: Option<Vec<Filter>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_results: Option<i32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_token: Option<String>,
+}
+
+/// Response from describing snapshots.
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DescribeSnapshotsResponse {
+    #[serde(rename = "snapshotSet")]
+    pub snapshot_set: Option<SnapshotSet>,
+    #[serde(rename = "nextToken")]
+    pub next_token: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SnapshotSet {
+    #[serde(rename = "item", default)]
+    pub items: Vec<Snapshot>,
+}
+
+/// An EBS snapshot, as returned by `CreateSnapshot` and `DescribeSnapshots`.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Snapshot {
+    pub snapshot_id: Option<String>,
+    pub volume_id: Option<String>,
+    /// `pending`, `completed`, `error`, `recoverable` or `recovering`.
+    #[serde(rename = "status")]
+    pub state: Option<String>,
+    pub status_message: Option<String>,
+    pub start_time: Option<String>,
+    pub progress: Option<String>,
+    pub owner_id: Option<String>,
+    /// Size of the source volume in GiB.
+    pub volume_size: Option<i32>,
+    pub description: Option<String>,
+    pub encrypted: Option<bool>,
+    pub storage_tier: Option<String>,
+    #[serde(rename = "tagSet")]
+    pub tag_set: Option<TagSet>,
+}
+
+/// Request to add or overwrite tags on EC2 resources.
+#[derive(Debug, Clone, Serialize, Builder)]
+pub struct CreateTagsRequest {
+    pub resource_ids: Vec<String>,
+    pub tags: Vec<Tag>,
+}
+
+/// Request to remove tags (by key, whatever their value) from EC2 resources.
+#[derive(Debug, Clone, Serialize, Builder)]
+pub struct DeleteTagsRequest {
+    pub resource_ids: Vec<String>,
+    pub tag_keys: Vec<String>,
+}
+
 /// Request to attach a volume.
 #[derive(Debug, Clone, Serialize, Builder)]
 pub struct AttachVolumeRequest {
@@ -3866,6 +4090,199 @@ mod error_mapping_tests {
 mod volume_operation_tests {
     use super::*;
 
+    #[test]
+    fn create_volume_from_snapshot_sends_snapshot_id() {
+        let request = CreateVolumeRequest::builder()
+            .availability_zone("us-west-2a".to_string())
+            .snapshot_id("snap-0123456789abcdef0".to_string())
+            .size(64)
+            .build();
+
+        let form = Ec2Client::create_volume_form_data(&request);
+
+        assert_eq!(
+            form.get("SnapshotId").map(String::as_str),
+            Some("snap-0123456789abcdef0")
+        );
+        assert_eq!(form.get("Size").map(String::as_str), Some("64"));
+    }
+
+    #[test]
+    fn snapshot_operations_map_to_ec2_query_parameters() {
+        let create = CreateSnapshotRequest::builder()
+            .volume_id("vol-0123456789abcdef0".to_string())
+            .description("final snapshot".to_string())
+            .tag_specifications(vec![TagSpecification {
+                resource_type: "snapshot".to_string(),
+                tags: vec![Tag {
+                    key: "alien-snapshot-kind".to_string(),
+                    value: "final".to_string(),
+                }],
+            }])
+            .build();
+        let create_form = Ec2Client::create_snapshot_form_data(&create);
+        assert_eq!(
+            create_form.get("Action").map(String::as_str),
+            Some("CreateSnapshot")
+        );
+        assert_eq!(
+            create_form.get("VolumeId").map(String::as_str),
+            Some("vol-0123456789abcdef0")
+        );
+        assert_eq!(
+            create_form
+                .get("TagSpecification.1.ResourceType")
+                .map(String::as_str),
+            Some("snapshot")
+        );
+        assert_eq!(
+            create_form
+                .get("TagSpecification.1.Tag.1.Key")
+                .map(String::as_str),
+            Some("alien-snapshot-kind")
+        );
+
+        let describe = DescribeSnapshotsRequest::builder()
+            .owner_ids(vec!["self".to_string()])
+            .filters(vec![Filter {
+                name: "tag:Container".to_string(),
+                values: vec!["db".to_string()],
+            }])
+            .max_results(1000)
+            .build();
+        let describe_form = Ec2Client::describe_snapshots_form_data(&describe);
+        assert_eq!(describe_form.get("Owner.1").map(String::as_str), Some("self"));
+        assert_eq!(
+            describe_form.get("Filter.1.Name").map(String::as_str),
+            Some("tag:Container")
+        );
+        assert_eq!(
+            describe_form.get("Filter.1.Value.1").map(String::as_str),
+            Some("db")
+        );
+        assert_eq!(
+            describe_form.get("MaxResults").map(String::as_str),
+            Some("1000")
+        );
+        assert!(!describe_form.contains_key("SnapshotId.1"));
+    }
+
+    #[test]
+    fn tag_operations_map_to_ec2_query_parameters() {
+        let create = Ec2Client::create_tags_form_data(
+            &CreateTagsRequest::builder()
+                .resource_ids(vec!["vol-1".to_string()])
+                .tags(vec![Tag {
+                    key: "Ordinal".to_string(),
+                    value: "2".to_string(),
+                }])
+                .build(),
+        );
+        assert_eq!(create.get("Action").map(String::as_str), Some("CreateTags"));
+        assert_eq!(create.get("ResourceId.1").map(String::as_str), Some("vol-1"));
+        assert_eq!(create.get("Tag.1.Key").map(String::as_str), Some("Ordinal"));
+        assert_eq!(create.get("Tag.1.Value").map(String::as_str), Some("2"));
+
+        let delete = Ec2Client::delete_tags_form_data(
+            &DeleteTagsRequest::builder()
+                .resource_ids(vec!["vol-1".to_string()])
+                .tag_keys(vec!["RestoreOrdinal".to_string()])
+                .build(),
+        );
+        assert_eq!(delete.get("Action").map(String::as_str), Some("DeleteTags"));
+        assert_eq!(
+            delete.get("Tag.1.Key").map(String::as_str),
+            Some("RestoreOrdinal")
+        );
+        // Without a value, EC2 removes the tag whatever its value.
+        assert!(!delete.contains_key("Tag.1.Value"));
+    }
+
+    #[test]
+    fn describe_snapshots_reads_state_start_time_and_tags() {
+        let response: DescribeSnapshotsResponse = quick_xml::de::from_str(
+            r#"<DescribeSnapshotsResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/">
+                <requestId>12345678-1234-1234-1234-3755ba4b9fa6</requestId>
+                <snapshotSet>
+                    <item>
+                        <snapshotId>snap-0abcdef1234567890</snapshotId>
+                        <volumeId>vol-01234567890abcdef</volumeId>
+                        <status>completed</status>
+                        <startTime>2025-02-03T23:53:18.195Z</startTime>
+                        <progress>100%</progress>
+                        <ownerId>123456789012</ownerId>
+                        <volumeSize>8</volumeSize>
+                        <description>My root volume snapshot</description>
+                        <tagSet>
+                            <item><key>Ordinal</key><value>1</value></item>
+                        </tagSet>
+                        <encrypted>true</encrypted>
+                        <storageTier>standard</storageTier>
+                    </item>
+                </snapshotSet>
+            </DescribeSnapshotsResponse>"#,
+        )
+        .expect("DescribeSnapshots response should deserialize");
+        let snapshot = &response.snapshot_set.expect("snapshot set").items[0];
+        assert_eq!(snapshot.snapshot_id.as_deref(), Some("snap-0abcdef1234567890"));
+        assert_eq!(snapshot.state.as_deref(), Some("completed"));
+        assert_eq!(
+            snapshot.start_time.as_deref(),
+            Some("2025-02-03T23:53:18.195Z")
+        );
+        assert_eq!(snapshot.volume_size, Some(8));
+        assert_eq!(snapshot.owner_id.as_deref(), Some("123456789012"));
+        let tags = &snapshot.tag_set.as_ref().expect("tags").items;
+        assert_eq!((tags[0].key.as_str(), tags[0].value.as_str()), ("Ordinal", "1"));
+
+        let created: Snapshot = quick_xml::de::from_str(
+            r#"<CreateSnapshotResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/">
+                <requestId>59dbff89-35bd-4eac-99ed-be587EXAMPLE</requestId>
+                <snapshotId>snap-1234567890abcdef0</snapshotId>
+                <volumeId>vol-1234567890abcdef0</volumeId>
+                <status>pending</status>
+                <startTime>2025-02-03T23:53:18.000Z</startTime>
+                <progress>60%</progress>
+                <ownerId>111122223333</ownerId>
+                <volumeSize>30</volumeSize>
+                <description>Daily Backup</description>
+            </CreateSnapshotResponse>"#,
+        )
+        .expect("CreateSnapshot response should deserialize");
+        assert_eq!(created.snapshot_id.as_deref(), Some("snap-1234567890abcdef0"));
+        assert_eq!(created.state.as_deref(), Some("pending"));
+    }
+
+    #[test]
+    fn snapshot_error_codes_map_to_their_kind() {
+        let body = |code: &str| {
+            format!(
+                "<Response><Errors><Error><Code>{code}</Code><Message>m</Message></Error></Errors>\
+                 <RequestID>r</RequestID></Response>"
+            )
+        };
+        assert!(matches!(
+            Ec2Client::map_ec2_error(
+                StatusCode::BAD_REQUEST,
+                &body("InvalidSnapshot.NotFound"),
+                "DescribeSnapshots",
+                "snap-1",
+                None
+            ),
+            Some(ErrorData::RemoteResourceNotFound { .. })
+        ));
+        assert!(matches!(
+            Ec2Client::map_ec2_error(
+                StatusCode::BAD_REQUEST,
+                &body("InvalidSnapshot.InUse"),
+                "DeleteSnapshot",
+                "snap-1",
+                None
+            ),
+            Some(ErrorData::RemoteResourceConflict { .. })
+        ));
+    }
+
     #[test]
     fn create_volume_maps_idempotency_token_to_ec2_query_parameter() {
         let request = CreateVolumeRequest::builder()
@@ -4134,6 +4551,40 @@ mod tests {
         assert_eq!(volumes[0].state.as_deref(), Some("available"));
     }
 
+    #[test]
+    fn describe_volumes_reads_the_attachment_status() {
+        // Sample from the EC2 DescribeVolumes reference: the attachment state is `<status>`.
+        let response: DescribeVolumesResponse = quick_xml::de::from_str(
+            r#"<DescribeVolumesResponse xmlns="http://ec2.amazonaws.com/doc/2016-11-15/">
+                <volumeSet>
+                    <item>
+                        <volumeId>vol-1234567890abcdef0</volumeId>
+                        <size>80</size>
+                        <availabilityZone>us-east-1a</availabilityZone>
+                        <status>in-use</status>
+                        <attachmentSet>
+                            <item>
+                                <volumeId>vol-1234567890abcdef0</volumeId>
+                                <instanceId>i-1234567890abcdef0</instanceId>
+                                <device>/dev/sdh</device>
+                                <status>attached</status>
+                                <attachTime>YYYY-MM-DDTHH:MM:SS.SSSZ</attachTime>
+                                <deleteOnTermination>false</deleteOnTermination>
+                            </item>
+                        </attachmentSet>
+                        <volumeType>standard</volumeType>
+                    </item>
+                </volumeSet>
+            </DescribeVolumesResponse>"#,
+        )
+        .expect("DescribeVolumes response should deserialize");
+        let volume = &response.volume_set.expect("volume set").items[0];
+        let attachment = &volume.attachment_set.as_ref().expect("attachments").items[0];
+        assert_eq!(volume.state.as_deref(), Some("in-use"));
+        assert_eq!(attachment.state.as_deref(), Some("attached"));
+        assert_eq!(attachment.instance_id.as_deref(), Some("i-1234567890abcdef0"));
+    }
+
     #[test]
     fn launch_template_already_exists_is_a_typed_resource_conflict() {
         let response = r#"<?xml version="1.0" encoding="UTF-8"?>
diff --git a/crates/alien-aws-clients/src/aws/mod.rs b/crates/alien-aws-clients/src/aws/mod.rs
index 82dc6b19fe..cf2a2b5b37 100644
--- a/crates/alien-aws-clients/src/aws/mod.rs
+++ b/crates/alien-aws-clients/src/aws/mod.rs
@@ -55,6 +55,7 @@ pub mod cloudformation;
 pub mod cloudwatch;
 pub mod codebuild;
 pub mod credential_provider;
+pub mod dlm;
 pub mod dynamodb;
 pub mod ec2;
 pub mod ecr;
diff --git a/crates/alien-aws-clients/src/lib.rs b/crates/alien-aws-clients/src/lib.rs
index b37a2c187f..ec94b53c9e 100644
--- a/crates/alien-aws-clients/src/lib.rs
+++ b/crates/alien-aws-clients/src/lib.rs
@@ -14,6 +14,7 @@ pub use aws::cloudcontrol::{CloudControlApi, CloudControlClient};
 pub use aws::cloudformation::{CloudFormationApi, CloudFormationClient};
 pub use aws::cloudwatch::{CloudWatchApi, CloudWatchClient};
 pub use aws::codebuild::{CodeBuildApi, CodeBuildClient};
+pub use aws::dlm::{DlmApi, DlmClient};
 pub use aws::dynamodb::{DynamoDbApi, DynamoDbClient};
 pub use aws::ec2::{Ec2Api, Ec2Client};
 pub use aws::ecr::{EcrApi, EcrClient};
diff --git a/crates/alien-azure-clients/src/azure/data_protection.rs b/crates/alien-azure-clients/src/azure/data_protection.rs
new file mode 100644
index 0000000000..ed489ccb06
--- /dev/null
+++ b/crates/alien-azure-clients/src/azure/data_protection.rs
@@ -0,0 +1,1273 @@
+//! Azure Data Protection client (Azure Backup's Backup vaults).
+//!
+//! Covers what Azure Disk Backup needs: a Backup vault with a system-assigned identity, backup
+//! policies for `Microsoft.Compute/disks`, and backup instances that tie a managed disk to a
+//! policy. Disk backups live only in the operational store: Azure Backup takes incremental
+//! snapshots into a resource group of the caller's choosing and expires them per the policy.
+//!
+//! REST reference: https://learn.microsoft.com/en-us/rest/api/dataprotection/
+//! Disk backup walkthrough:
+//! https://learn.microsoft.com/en-us/azure/backup/backup-azure-dataprotection-use-rest-api-backup-disks
+
+use crate::azure::common::{AzureClientBase, AzureRequestBuilder};
+use crate::azure::long_running_operation::OperationResult;
+use crate::azure::token_cache::AzureTokenCache;
+use alien_client_core::{Error, ErrorData, Result};
+use alien_error::{Context, IntoAlienError};
+use reqwest::{Client, Method};
+use serde::{de::DeserializeOwned, Deserialize, Serialize};
+use std::collections::HashMap;
+
+#[cfg(feature = "test-utils")]
+use mockall::automock;
+
+const MANAGEMENT_SCOPE: &str = "https://management.azure.com/.default";
+
+/// Datasource type of an Azure managed disk.
+pub const DISK_DATASOURCE_TYPE: &str = "Microsoft.Compute/disks";
+
+/// Built-in role the vault identity needs on each protected disk.
+/// https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute#disk-backup-reader
+pub const DISK_BACKUP_READER_ROLE_ID: &str = "3e5e47e6-65f7-47ef-90b5-e5dd4d455f24";
+
+/// Built-in role the vault identity needs on the resource group that holds the snapshots.
+/// https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute#disk-snapshot-contributor
+pub const DISK_SNAPSHOT_CONTRIBUTOR_ROLE_ID: &str = "7efff54f-a5b4-42b5-a1c5-5411624893ce";
+
+/// Error code Azure Backup returns while the vault identity lacks (or does not yet see) the role
+/// assignments it needs. Role assignments take minutes to propagate.
+const MISSING_PERMISSIONS_ERROR_CODE: &str = "UserErrorMissingRequiredPermissions";
+
+/// True when Azure Backup rejected a request because the vault identity's role assignments are
+/// missing or have not propagated yet. Callers requeue on this instead of failing.
+pub fn is_missing_permissions_error(error: &Error) -> bool {
+    serde_json::to_string(error)
+        .map(|serialized| serialized.contains(MISSING_PERMISSIONS_ERROR_CODE))
+        .unwrap_or(false)
+}
+
+// ─────────────────────────── vault models ───────────────────────────
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupVault {
+    pub location: String,
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub tags: HashMap<String, String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub identity: Option<BackupVaultIdentity>,
+    pub properties: BackupVaultProperties,
+    /// ARM resource ID (response only).
+    #[serde(default, skip_serializing)]
+    pub id: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupVaultIdentity {
+    /// "SystemAssigned" for the vault's own identity.
+    #[serde(rename = "type")]
+    pub type_: String,
+    /// Object ID of the system-assigned identity (response only).
+    #[serde(default, skip_serializing)]
+    pub principal_id: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupVaultProperties {
+    /// Required by the API even for operational-store-only workloads such as disks.
+    pub storage_settings: Vec<StorageSetting>,
+    #[serde(default, skip_serializing)]
+    pub provisioning_state: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct StorageSetting {
+    /// "VaultStore" (the only vault datastore type).
+    pub datastore_type: String,
+    /// "LocallyRedundant", "GeoRedundant" or "ZoneRedundant".
+    #[serde(rename = "type")]
+    pub type_: String,
+}
+
+// ─────────────────────────── policy models ───────────────────────────
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupPolicyResource {
+    pub properties: BackupPolicy,
+    #[serde(default, skip_serializing)]
+    pub id: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupPolicy {
+    /// Always "BackupPolicy".
+    pub object_type: String,
+    pub datasource_types: Vec<String>,
+    pub policy_rules: Vec<PolicyRule>,
+}
+
+/// A backup policy rule, discriminated by `objectType`.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(tag = "objectType")]
+pub enum PolicyRule {
+    /// When backups are taken and which datastore they go to.
+    #[serde(rename = "AzureBackupRule", rename_all = "camelCase")]
+    Backup {
+        name: String,
+        backup_parameters: BackupParameters,
+        data_store: DataStoreInfo,
+        trigger: ScheduleTrigger,
+    },
+    /// How long backups are kept.
+    #[serde(rename = "AzureRetentionRule", rename_all = "camelCase")]
+    Retention {
+        name: String,
+        is_default: bool,
+        lifecycles: Vec<RetentionLifecycle>,
+    },
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupParameters {
+    /// Always "AzureBackupParams".
+    pub object_type: String,
+    /// "Incremental" for disks.
+    pub backup_type: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct DataStoreInfo {
+    /// "OperationalStore" for disks.
+    pub data_store_type: String,
+    /// Always "DataStoreInfoBase".
+    pub object_type: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct ScheduleTrigger {
+    /// Always "ScheduleBasedTriggerContext".
+    pub object_type: String,
+    pub schedule: BackupSchedule,
+    pub tagging_criteria: Vec<TaggingCriteria>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupSchedule {
+    /// ISO 8601 repeating intervals, e.g. `R/2024-01-01T00:00:00+00:00/PT4H`.
+    pub repeating_time_intervals: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct TaggingCriteria {
+    pub is_default: bool,
+    pub tag_info: RetentionTag,
+    pub tagging_priority: i64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct RetentionTag {
+    pub tag_name: String,
+    /// Response only; the service derives it from the tag name.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct RetentionLifecycle {
+    pub delete_after: DeleteOption,
+    pub source_data_store: DataStoreInfo,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct DeleteOption {
+    /// Always "AbsoluteDeleteOption".
+    pub object_type: String,
+    /// ISO 8601 duration, e.g. `P7D`.
+    pub duration: String,
+}
+
+/// How often a disk backup policy takes snapshots.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DiskBackupFrequency {
+    /// Every N hours. Azure Disk Backup accepts 1, 2, 4, 6, 8 and 12 for Standard HDD,
+    /// Standard SSD and Premium SSD disks.
+    Hours(u32),
+    /// Once a day.
+    Daily,
+}
+
+impl DiskBackupFrequency {
+    fn iso_duration(self) -> String {
+        match self {
+            DiskBackupFrequency::Hours(hours) => format!("PT{hours}H"),
+            DiskBackupFrequency::Daily => "P1D".to_string(),
+        }
+    }
+}
+
+impl BackupPolicy {
+    /// An operational-store disk backup policy: one snapshot every `frequency` starting at
+    /// `start` (RFC 3339 date-time; the service requires a full date-time, not a time of day),
+    /// each kept for `retention_days`.
+    ///
+    /// Mirrors the request body in
+    /// https://learn.microsoft.com/en-us/azure/backup/backup-azure-dataprotection-use-rest-api-create-update-disk-policy
+    pub fn disk_operational(
+        start: &str,
+        frequency: DiskBackupFrequency,
+        retention_days: u32,
+    ) -> Self {
+        let operational_store = || DataStoreInfo {
+            data_store_type: "OperationalStore".to_string(),
+            object_type: "DataStoreInfoBase".to_string(),
+        };
+        let rule_name = match frequency {
+            DiskBackupFrequency::Hours(_) => "BackupHourly",
+            DiskBackupFrequency::Daily => "BackupDaily",
+        };
+        BackupPolicy {
+            object_type: "BackupPolicy".to_string(),
+            datasource_types: vec![DISK_DATASOURCE_TYPE.to_string()],
+            policy_rules: vec![
+                PolicyRule::Backup {
+                    name: rule_name.to_string(),
+                    backup_parameters: BackupParameters {
+                        object_type: "AzureBackupParams".to_string(),
+                        backup_type: "Incremental".to_string(),
+                    },
+                    data_store: operational_store(),
+                    trigger: ScheduleTrigger {
+                        object_type: "ScheduleBasedTriggerContext".to_string(),
+                        schedule: BackupSchedule {
+                            repeating_time_intervals: vec![format!(
+                                "R/{start}/{}",
+                                frequency.iso_duration()
+                            )],
+                        },
+                        tagging_criteria: vec![TaggingCriteria {
+                            is_default: true,
+                            tag_info: RetentionTag {
+                                tag_name: "Default".to_string(),
+                                id: None,
+                            },
+                            tagging_priority: 99,
+                        }],
+                    },
+                },
+                PolicyRule::Retention {
+                    name: "Default".to_string(),
+                    is_default: true,
+                    lifecycles: vec![RetentionLifecycle {
+                        delete_after: DeleteOption {
+                            object_type: "AbsoluteDeleteOption".to_string(),
+                            duration: format!("P{retention_days}D"),
+                        },
+                        source_data_store: operational_store(),
+                    }],
+                },
+            ],
+        }
+    }
+}
+
+// ─────────────────────────── backup instance models ───────────────────────────
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupInstanceResource {
+    pub properties: BackupInstance,
+    #[serde(default, skip_serializing)]
+    pub id: Option<String>,
+    #[serde(default, skip_serializing)]
+    pub name: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct BackupInstance {
+    /// Always "BackupInstance".
+    pub object_type: String,
+    pub data_source_info: Datasource,
+    pub policy_info: PolicyInfo,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub friendly_name: Option<String>,
+    /// e.g. "ConfiguringProtection", "ProtectionConfigured", "BackupsSuspended" (response only).
+    #[serde(default, skip_serializing)]
+    pub current_protection_state: Option<String>,
+    /// e.g. "Provisioning", "Succeeded", "Failed" (response only).
+    #[serde(default, skip_serializing)]
+    pub provisioning_state: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct Datasource {
+    pub datasource_type: String,
+    /// Always "Datasource".
+    pub object_type: String,
+    /// ARM ID of the protected disk. The API spells it `resourceID`.
+    #[serde(rename = "resourceID")]
+    pub resource_id: String,
+    pub resource_location: String,
+    pub resource_name: String,
+    pub resource_type: String,
+    #[serde(default)]
+    pub resource_uri: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct PolicyInfo {
+    pub policy_id: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy_parameters: Option<PolicyParameters>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct PolicyParameters {
+    #[serde(default)]
+    pub data_store_parameters_list: Vec<OperationalStoreParameters>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct OperationalStoreParameters {
+    /// Always "AzureOperationalStoreParameters".
+    pub object_type: String,
+    /// Always "OperationalStore".
+    pub data_store_type: String,
+    /// ARM ID of the resource group that receives the snapshots.
+    pub resource_group_id: String,
+}
+
+impl BackupInstance {
+    /// A backup instance protecting one managed disk with `policy_id`, storing its snapshots in
+    /// `snapshot_resource_group_id`.
+    pub fn for_disk(
+        disk_id: &str,
+        disk_name: &str,
+        location: &str,
+        policy_id: &str,
+        snapshot_resource_group_id: &str,
+    ) -> Self {
+        BackupInstance {
+            object_type: "BackupInstance".to_string(),
+            data_source_info: Datasource {
+                datasource_type: DISK_DATASOURCE_TYPE.to_string(),
+                object_type: "Datasource".to_string(),
+                resource_id: disk_id.to_string(),
+                resource_location: location.to_string(),
+                resource_name: disk_name.to_string(),
+                resource_type: DISK_DATASOURCE_TYPE.to_string(),
+                resource_uri: String::new(),
+            },
+            policy_info: PolicyInfo {
+                policy_id: policy_id.to_string(),
+                policy_parameters: Some(PolicyParameters {
+                    data_store_parameters_list: vec![OperationalStoreParameters {
+                        object_type: "AzureOperationalStoreParameters".to_string(),
+                        data_store_type: "OperationalStore".to_string(),
+                        resource_group_id: snapshot_resource_group_id.to_string(),
+                    }],
+                }),
+            },
+            friendly_name: None,
+            current_protection_state: None,
+            provisioning_state: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ValidateForBackupRequest<'a> {
+    backup_instance: &'a BackupInstance,
+}
+
+// ─────────────────────────── trait + client ───────────────────────────
+
+#[cfg_attr(feature = "test-utils", automock)]
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+pub trait DataProtectionApi: Send + Sync + std::fmt::Debug {
+    /// Creates or updates a Backup vault. Long-running.
+    async fn create_or_update_backup_vault(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        vault: &BackupVault,
+    ) -> Result<OperationResult<BackupVault>>;
+
+    async fn get_backup_vault(&self, resource_group: &str, vault_name: &str)
+        -> Result<BackupVault>;
+
+    /// Deletes a Backup vault. The vault must hold no active backup instances. Long-running.
+    async fn delete_backup_vault(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+    ) -> Result<OperationResult<()>>;
+
+    /// Creates a backup policy. Azure Backup does not support changing an existing policy; create
+    /// a new one and point the backup instances at it. Synchronous.
+    async fn create_backup_policy(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        policy_name: &str,
+        policy: &BackupPolicy,
+    ) -> Result<BackupPolicyResource>;
+
+    async fn get_backup_policy(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        policy_name: &str,
+    ) -> Result<BackupPolicyResource>;
+
+    /// Deletes a backup policy. It must not be in use by any backup instance. Synchronous.
+    async fn delete_backup_policy(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        policy_name: &str,
+    ) -> Result<()>;
+
+    /// Checks whether `backup_instance` could be configured, including the vault identity's
+    /// permissions. Long-running; a missing-permission failure surfaces when the operation
+    /// completes (see [`is_missing_permissions_error`]).
+    async fn validate_for_backup(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance: &BackupInstance,
+    ) -> Result<OperationResult<()>>;
+
+    /// Creates a backup instance, or points an existing one at a different policy. Long-running.
+    async fn create_or_update_backup_instance(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+        backup_instance: &BackupInstance,
+    ) -> Result<OperationResult<BackupInstanceResource>>;
+
+    async fn get_backup_instance(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+    ) -> Result<BackupInstanceResource>;
+
+    /// Stops future backups of an instance and keeps its recovery points ("stop protection and
+    /// retain data as per policy"; the latest one is kept until the instance is deleted).
+    /// Long-running.
+    async fn suspend_backups(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+    ) -> Result<OperationResult<()>>;
+
+    /// Resumes backups of an instance whose backups were suspended. Long-running.
+    async fn resume_backups(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+    ) -> Result<OperationResult<()>>;
+
+    /// Stops protection and deletes the instance's backup data. From API version 2025-09-01
+    /// the instance moves to soft delete; its operational snapshots stay until the soft-delete
+    /// period ends, and are never cleaned up if the vault is soft-deleted too. Long-running.
+    async fn delete_backup_instance(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+    ) -> Result<OperationResult<()>>;
+}
+
+#[derive(Debug)]
+pub struct AzureDataProtectionClient {
+    pub base: AzureClientBase,
+    pub token_cache: AzureTokenCache,
+}
+
+impl AzureDataProtectionClient {
+    /// Latest GA version of the Data Protection API.
+    const API_VERSION: &'static str = "2026-07-01";
+
+    pub fn new(client: Client, token_cache: AzureTokenCache) -> Self {
+        let endpoint = token_cache.management_endpoint().to_string();
+        Self {
+            base: AzureClientBase::with_client_config(
+                client,
+                endpoint,
+                token_cache.config().clone(),
+            ),
+            token_cache,
+        }
+    }
+
+    fn vault_path(&self, resource_group: &str, vault_name: &str) -> String {
+        format!(
+            "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.DataProtection/backupVaults/{}",
+            self.token_cache.config().subscription_id,
+            resource_group,
+            vault_name
+        )
+    }
+
+    fn url(&self, path: &str) -> String {
+        self.base.build_url(
+            path,
+            Some(vec![("api-version", Self::API_VERSION.to_string())]),
+        )
+    }
+
+    async fn signed_request(
+        &self,
+        method: Method,
+        url: String,
+        body: Option<String>,
+    ) -> Result<reqwest::Request> {
+        let token = self
+            .token_cache
+            .get_bearer_token_with_scope(MANAGEMENT_SCOPE)
+            .await?;
+        let builder = match body {
+            Some(body) => AzureRequestBuilder::new(method, url)
+                .content_type_json()
+                .content_length(&body)
+                .body(body),
+            None => AzureRequestBuilder::new(method, url).content_length(""),
+        };
+        self.base.sign_request(builder.build()?, &token).await
+    }
+
+    fn serialize<T: Serialize>(value: &T, what: &str) -> Result<String> {
+        serde_json::to_string(value)
+            .into_alien_error()
+            .context(ErrorData::SerializationError {
+                message: format!("Failed to serialize {what}"),
+            })
+    }
+
+    async fn get_json<T: DeserializeOwned>(&self, path: &str, op: &str, name: &str) -> Result<T> {
+        let req = self
+            .signed_request(Method::GET, self.url(path), None)
+            .await?;
+        let resp = self.base.execute_request(req, op, name).await?;
+        let body = resp
+            .text()
+            .await
+            .into_alien_error()
+            .context(ErrorData::SerializationError {
+                message: format!("Azure {op}: failed to read body for {name}"),
+            })?;
+        serde_json::from_str(&body)
+            .into_alien_error()
+            .context(ErrorData::SerializationError {
+                message: format!("Azure {op}: JSON parse error for {name}"),
+            })
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+impl DataProtectionApi for AzureDataProtectionClient {
+    async fn create_or_update_backup_vault(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        vault: &BackupVault,
+    ) -> Result<OperationResult<BackupVault>> {
+        let body = Self::serialize(vault, &format!("Backup vault {vault_name}"))?;
+        let req = self
+            .signed_request(
+                Method::PUT,
+                self.url(&self.vault_path(resource_group, vault_name)),
+                Some(body),
+            )
+            .await?;
+        self.base
+            .execute_request_with_long_running_support(req, "CreateOrUpdateBackupVault", vault_name)
+            .await
+    }
+
+    async fn get_backup_vault(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+    ) -> Result<BackupVault> {
+        self.get_json(
+            &self.vault_path(resource_group, vault_name),
+            "GetBackupVault",
+            vault_name,
+        )
+        .await
+    }
+
+    async fn delete_backup_vault(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+    ) -> Result<OperationResult<()>> {
+        let req = self
+            .signed_request(
+                Method::DELETE,
+                self.url(&self.vault_path(resource_group, vault_name)),
+                None,
+            )
+            .await?;
+        self.base
+            .execute_request_with_long_running_support(req, "DeleteBackupVault", vault_name)
+            .await
+    }
+
+    async fn create_backup_policy(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        policy_name: &str,
+        policy: &BackupPolicy,
+    ) -> Result<BackupPolicyResource> {
+        #[derive(Serialize)]
+        struct Body<'a> {
+            properties: &'a BackupPolicy,
+        }
+        let body = Self::serialize(
+            &Body { properties: policy },
+            &format!("backup policy {policy_name}"),
+        )?;
+        let path = format!(
+            "{}/backupPolicies/{policy_name}",
+            self.vault_path(resource_group, vault_name)
+        );
+        let req = self
+            .signed_request(Method::PUT, self.url(&path), Some(body))
+            .await?;
+        let resp = self
+            .base
+            .execute_request(req, "CreateBackupPolicy", policy_name)
+            .await?;
+        let body = resp
+            .text()
+            .await
+            .into_alien_error()
+            .context(ErrorData::SerializationError {
+                message: format!("Azure CreateBackupPolicy: failed to read body for {policy_name}"),
+            })?;
+        serde_json::from_str(&body)
+            .into_alien_error()
+            .context(ErrorData::SerializationError {
+                message: format!("Azure CreateBackupPolicy: JSON parse error for {policy_name}"),
+            })
+    }
+
+    async fn get_backup_policy(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        policy_name: &str,
+    ) -> Result<BackupPolicyResource> {
+        self.get_json(
+            &format!(
+                "{}/backupPolicies/{policy_name}",
+                self.vault_path(resource_group, vault_name)
+            ),
+            "GetBackupPolicy",
+            policy_name,
+        )
+        .await
+    }
+
+    async fn delete_backup_policy(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        policy_name: &str,
+    ) -> Result<()> {
+        let path = format!(
+            "{}/backupPolicies/{policy_name}",
+            self.vault_path(resource_group, vault_name)
+        );
+        let req = self
+            .signed_request(Method::DELETE, self.url(&path), None)
+            .await?;
+        self.base
+            .execute_request(req, "DeleteBackupPolicy", policy_name)
+            .await?;
+        Ok(())
+    }
+
+    async fn validate_for_backup(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance: &BackupInstance,
+    ) -> Result<OperationResult<()>> {
+        let name = &backup_instance.data_source_info.resource_name;
+        let body = Self::serialize(
+            &ValidateForBackupRequest { backup_instance },
+            &format!("validate-for-backup request for {name}"),
+        )?;
+        let path = format!(
+            "{}/validateForBackup",
+            self.vault_path(resource_group, vault_name)
+        );
+        let req = self
+            .signed_request(Method::POST, self.url(&path), Some(body))
+            .await?;
+        // A completed (200) validation returns an OperationJobExtendedInfo body the caller has no
+        // use for; only success or failure matters.
+        let result: OperationResult<serde_json::Value> = self
+            .base
+            .execute_request_with_long_running_support(req, "ValidateForBackup", name)
+            .await?;
+        Ok(match result {
+            OperationResult::Completed(_) => OperationResult::Completed(()),
+            OperationResult::LongRunning(operation) => OperationResult::LongRunning(operation),
+        })
+    }
+
+    async fn create_or_update_backup_instance(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+        backup_instance: &BackupInstance,
+    ) -> Result<OperationResult<BackupInstanceResource>> {
+        #[derive(Serialize)]
+        struct Body<'a> {
+            properties: &'a BackupInstance,
+        }
+        let body = Self::serialize(
+            &Body {
+                properties: backup_instance,
+            },
+            &format!("backup instance {backup_instance_name}"),
+        )?;
+        let path = format!(
+            "{}/backupInstances/{backup_instance_name}",
+            self.vault_path(resource_group, vault_name)
+        );
+        let req = self
+            .signed_request(Method::PUT, self.url(&path), Some(body))
+            .await?;
+        self.base
+            .execute_request_with_long_running_support(
+                req,
+                "CreateOrUpdateBackupInstance",
+                backup_instance_name,
+            )
+            .await
+    }
+
+    async fn get_backup_instance(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+    ) -> Result<BackupInstanceResource> {
+        self.get_json(
+            &format!(
+                "{}/backupInstances/{backup_instance_name}",
+                self.vault_path(resource_group, vault_name)
+            ),
+            "GetBackupInstance",
+            backup_instance_name,
+        )
+        .await
+    }
+
+    async fn suspend_backups(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+    ) -> Result<OperationResult<()>> {
+        let path = format!(
+            "{}/backupInstances/{backup_instance_name}/suspendBackups",
+            self.vault_path(resource_group, vault_name)
+        );
+        let req = self
+            .signed_request(Method::POST, self.url(&path), Some("{}".to_string()))
+            .await?;
+        let result: OperationResult<serde_json::Value> = self
+            .base
+            .execute_request_with_long_running_support(req, "SuspendBackups", backup_instance_name)
+            .await?;
+        Ok(match result {
+            OperationResult::Completed(_) => OperationResult::Completed(()),
+            OperationResult::LongRunning(operation) => OperationResult::LongRunning(operation),
+        })
+    }
+
+    async fn resume_backups(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+    ) -> Result<OperationResult<()>> {
+        let path = format!(
+            "{}/backupInstances/{backup_instance_name}/resumeBackups",
+            self.vault_path(resource_group, vault_name)
+        );
+        let req = self
+            .signed_request(Method::POST, self.url(&path), None)
+            .await?;
+        let result: OperationResult<serde_json::Value> = self
+            .base
+            .execute_request_with_long_running_support(req, "ResumeBackups", backup_instance_name)
+            .await?;
+        Ok(match result {
+            OperationResult::Completed(_) => OperationResult::Completed(()),
+            OperationResult::LongRunning(operation) => OperationResult::LongRunning(operation),
+        })
+    }
+
+    async fn delete_backup_instance(
+        &self,
+        resource_group: &str,
+        vault_name: &str,
+        backup_instance_name: &str,
+    ) -> Result<OperationResult<()>> {
+        let path = format!(
+            "{}/backupInstances/{backup_instance_name}",
+            self.vault_path(resource_group, vault_name)
+        );
+        let req = self
+            .signed_request(Method::DELETE, self.url(&path), None)
+            .await?;
+        self.base
+            .execute_request_with_long_running_support(
+                req,
+                "DeleteBackupInstance",
+                backup_instance_name,
+            )
+            .await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+
+    use alien_error::AlienError;
+    use httpmock::{Method::DELETE, Method::GET, Method::POST, Method::PUT, MockServer};
+    use serde_json::json;
+
+    use super::*;
+    use crate::azure::{AzureClientConfig, AzureClientConfigExt, ServiceOverrides};
+
+    const VAULT_PATH: &str = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg/providers/Microsoft.DataProtection/backupVaults/stack-db-backups";
+
+    fn test_client(server: &MockServer) -> AzureDataProtectionClient {
+        let config = AzureClientConfig::mock().with_service_overrides(ServiceOverrides {
+            endpoints: HashMap::from([("management".to_string(), server.base_url())]),
+        });
+        AzureDataProtectionClient::new(Client::new(), AzureTokenCache::new(config))
+    }
+
+    #[test]
+    fn hourly_policy_matches_documented_disk_policy_body() {
+        // The documented example, minus the response-only tag id.
+        let expected = json!({
+            "objectType": "BackupPolicy",
+            "datasourceTypes": ["Microsoft.Compute/disks"],
+            "policyRules": [
+                {
+                    "objectType": "AzureBackupRule",
+                    "name": "BackupHourly",
+                    "backupParameters": {"objectType": "AzureBackupParams", "backupType": "Incremental"},
+                    "dataStore": {"dataStoreType": "OperationalStore", "objectType": "DataStoreInfoBase"},
+                    "trigger": {
+                        "objectType": "ScheduleBasedTriggerContext",
+                        "schedule": {"repeatingTimeIntervals": ["R/2020-04-05T13:00:00+00:00/PT4H"]},
+                        "taggingCriteria": [{
+                            "isDefault": true,
+                            "tagInfo": {"tagName": "Default"},
+                            "taggingPriority": 99
+                        }]
+                    }
+                },
+                {
+                    "objectType": "AzureRetentionRule",
+                    "name": "Default",
+                    "isDefault": true,
+                    "lifecycles": [{
+                        "deleteAfter": {"objectType": "AbsoluteDeleteOption", "duration": "P7D"},
+                        "sourceDataStore": {"dataStoreType": "OperationalStore", "objectType": "DataStoreInfoBase"}
+                    }]
+                }
+            ]
+        });
+        let policy = BackupPolicy::disk_operational(
+            "2020-04-05T13:00:00+00:00",
+            DiskBackupFrequency::Hours(4),
+            7,
+        );
+        assert_eq!(serde_json::to_value(&policy).unwrap(), expected);
+    }
+
+    #[test]
+    fn daily_policy_uses_p1d_and_daily_rule() {
+        let policy = BackupPolicy::disk_operational(
+            "2024-01-01T00:00:00+00:00",
+            DiskBackupFrequency::Daily,
+            30,
+        );
+        let json = serde_json::to_value(&policy).unwrap();
+        assert_eq!(json["policyRules"][0]["name"], "BackupDaily");
+        assert_eq!(
+            json["policyRules"][0]["trigger"]["schedule"]["repeatingTimeIntervals"][0],
+            "R/2024-01-01T00:00:00+00:00/P1D"
+        );
+        assert_eq!(
+            json["policyRules"][1]["lifecycles"][0]["deleteAfter"]["duration"],
+            "P30D"
+        );
+    }
+
+    #[test]
+    fn policy_response_round_trips() {
+        // Response shape from the documentation (extra response fields are ignored).
+        let body = json!({
+            "id": "/subscriptions/s/resourceGroups/rg/providers/Microsoft.DataProtection/backupVaults/v/backupPolicies/p",
+            "name": "p",
+            "properties": {
+                "policyRules": [
+                    {
+                        "backupParameters": {"backupType": "Incremental", "objectType": "AzureBackupParams"},
+                        "trigger": {
+                            "schedule": {"repeatingTimeIntervals": ["R/2021-07-01T19:00:00+00:00/P1D"]},
+                            "taggingCriteria": [{"tagInfo": {"tagName": "Default", "id": "Default_"}, "taggingPriority": 99, "isDefault": true}],
+                            "objectType": "ScheduleBasedTriggerContext"
+                        },
+                        "dataStore": {"dataStoreType": "OperationalStore", "objectType": "DataStoreInfoBase"},
+                        "name": "BackupDaily",
+                        "objectType": "AzureBackupRule"
+                    },
+                    {
+                        "lifecycles": [{
+                            "deleteAfter": {"objectType": "AbsoluteDeleteOption", "duration": "P7D"},
+                            "targetDataStoreCopySettings": [],
+                            "sourceDataStore": {"dataStoreType": "OperationalStore", "objectType": "DataStoreInfoBase"}
+                        }],
+                        "isDefault": true,
+                        "name": "Default",
+                        "objectType": "AzureRetentionRule"
+                    }
+                ],
+                "datasourceTypes": ["Microsoft.Compute/disks"],
+                "objectType": "BackupPolicy"
+            }
+        });
+        let parsed: BackupPolicyResource = serde_json::from_value(body).unwrap();
+        assert_eq!(
+            parsed.properties,
+            with_response_tag_id(BackupPolicy::disk_operational(
+                "2021-07-01T19:00:00+00:00",
+                DiskBackupFrequency::Daily,
+                7
+            ))
+        );
+    }
+
+    /// The service echoes the derived tag id in responses.
+    fn with_response_tag_id(mut policy: BackupPolicy) -> BackupPolicy {
+        for rule in &mut policy.policy_rules {
+            if let PolicyRule::Backup { trigger, .. } = rule {
+                for criteria in &mut trigger.tagging_criteria {
+                    criteria.tag_info.id = Some("Default_".to_string());
+                }
+            }
+        }
+        policy
+    }
+
+    #[tokio::test]
+    async fn creates_vault_with_system_assigned_identity() {
+        let server = MockServer::start_async().await;
+        let mock = server
+            .mock_async(|when, then| {
+                when.method(PUT)
+                    .path(VAULT_PATH)
+                    .query_param("api-version", "2026-07-01")
+                    .json_body(json!({
+                        "location": "eastus",
+                        "tags": {"alien-stack": "stack"},
+                        "identity": {"type": "SystemAssigned"},
+                        "properties": {
+                            "storageSettings": [{"datastoreType": "VaultStore", "type": "LocallyRedundant"}]
+                        }
+                    }));
+                then.status(200).json_body(json!({
+                    "id": VAULT_PATH,
+                    "location": "eastus",
+                    "identity": {"type": "SystemAssigned", "principalId": "principal-1", "tenantId": "t"},
+                    "properties": {
+                        "provisioningState": "Succeeded",
+                        "storageSettings": [{"datastoreType": "VaultStore", "type": "LocallyRedundant"}]
+                    }
+                }));
+            })
+            .await;
+
+        let vault = BackupVault {
+            location: "eastus".to_string(),
+            tags: HashMap::from([("alien-stack".to_string(), "stack".to_string())]),
+            identity: Some(BackupVaultIdentity {
+                type_: "SystemAssigned".to_string(),
+                principal_id: None,
+            }),
+            properties: BackupVaultProperties {
+                storage_settings: vec![StorageSetting {
+                    datastore_type: "VaultStore".to_string(),
+                    type_: "LocallyRedundant".to_string(),
+                }],
+                provisioning_state: None,
+            },
+            id: None,
+        };
+        let result = test_client(&server)
+            .create_or_update_backup_vault("rg", "stack-db-backups", &vault)
+            .await
+            .expect("vault create");
+        mock.assert_async().await;
+        let OperationResult::Completed(created) = result else {
+            panic!("expected a synchronous completion");
+        };
+        assert_eq!(
+            created.identity.and_then(|identity| identity.principal_id),
+            Some("principal-1".to_string())
+        );
+        assert_eq!(created.id.as_deref(), Some(VAULT_PATH));
+    }
+
+    #[tokio::test]
+    async fn backup_instance_put_uses_documented_body_and_returns_long_running_operation() {
+        let server = MockServer::start_async().await;
+        let disk_id = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg/providers/Microsoft.Compute/disks/stack-db-disk-0";
+        let policy_id = format!("{VAULT_PATH}/backupPolicies/backups-4h-7d");
+        let mock = server
+            .mock_async(|when, then| {
+                when.method(PUT)
+                    .path(format!("{VAULT_PATH}/backupInstances/stack-db-disk-0"))
+                    .query_param("api-version", "2026-07-01")
+                    .json_body(json!({
+                        "properties": {
+                            "objectType": "BackupInstance",
+                            "dataSourceInfo": {
+                                "datasourceType": "Microsoft.Compute/disks",
+                                "objectType": "Datasource",
+                                "resourceID": disk_id,
+                                "resourceLocation": "eastus",
+                                "resourceName": "stack-db-disk-0",
+                                "resourceType": "Microsoft.Compute/disks",
+                                "resourceUri": ""
+                            },
+                            "policyInfo": {
+                                "policyId": policy_id,
+                                "policyParameters": {
+                                    "dataStoreParametersList": [{
+                                        "objectType": "AzureOperationalStoreParameters",
+                                        "dataStoreType": "OperationalStore",
+                                        "resourceGroupId": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg"
+                                    }]
+                                }
+                            }
+                        }
+                    }));
+                then.status(201)
+                    .header(
+                        "Azure-AsyncOperation",
+                        "https://management.azure.com/subscriptions/s/providers/Microsoft.DataProtection/locations/eastus/operationStatus/op1",
+                    )
+                    .json_body(json!({"properties": {"provisioningState": "Provisioning"}}));
+            })
+            .await;
+
+        let instance = BackupInstance::for_disk(
+            disk_id,
+            "stack-db-disk-0",
+            "eastus",
+            &policy_id,
+            "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg",
+        );
+        let result = test_client(&server)
+            .create_or_update_backup_instance(
+                "rg",
+                "stack-db-backups",
+                "stack-db-disk-0",
+                &instance,
+            )
+            .await
+            .expect("backup instance put");
+        mock.assert_async().await;
+        let OperationResult::LongRunning(operation) = result else {
+            panic!("expected a long-running operation");
+        };
+        assert!(operation.url.ends_with("/operationStatus/op1"));
+    }
+
+    #[tokio::test]
+    async fn validate_for_backup_wraps_instance_and_tracks_operation() {
+        let server = MockServer::start_async().await;
+        let mock = server
+            .mock_async(|when, then| {
+                when.method(POST)
+                    .path(format!("{VAULT_PATH}/validateForBackup"))
+                    .query_param("api-version", "2026-07-01")
+                    .json_body_partial(
+                        r#"{"backupInstance": {"objectType": "BackupInstance", "dataSourceInfo": {"resourceName": "stack-db-disk-0"}}}"#,
+                    );
+                then.status(202)
+                    .header("Retry-After", "10")
+                    .header(
+                        "Azure-AsyncOperation",
+                        "https://management.azure.com/subscriptions/s/providers/Microsoft.DataProtection/locations/eastus/operationStatus/op2",
+                    );
+            })
+            .await;
+        let instance =
+            BackupInstance::for_disk("disk-id", "stack-db-disk-0", "eastus", "policy-id", "rg-id");
+        let result = test_client(&server)
+            .validate_for_backup("rg", "stack-db-backups", &instance)
+            .await
+            .expect("validate");
+        mock.assert_async().await;
+        let OperationResult::LongRunning(operation) = result else {
+            panic!("expected a long-running operation");
+        };
+        assert_eq!(
+            operation.retry_after,
+            Some(std::time::Duration::from_secs(10))
+        );
+    }
+
+    #[tokio::test]
+    async fn missing_permissions_rejection_is_recognized() {
+        let server = MockServer::start_async().await;
+        server
+            .mock_async(|when, then| {
+                when.method(PUT)
+                    .path(format!("{VAULT_PATH}/backupInstances/stack-db-disk-0"));
+                then.status(400).json_body(json!({
+                    "error": {
+                        "code": "UserErrorMissingRequiredPermissions",
+                        "message": "Appropriate permissions to perform the operation is missing."
+                    }
+                }));
+            })
+            .await;
+        let instance =
+            BackupInstance::for_disk("disk-id", "stack-db-disk-0", "eastus", "policy-id", "rg-id");
+        let error = test_client(&server)
+            .create_or_update_backup_instance(
+                "rg",
+                "stack-db-backups",
+                "stack-db-disk-0",
+                &instance,
+            )
+            .await
+            .expect_err("permissions are missing");
+        assert!(is_missing_permissions_error(&error));
+
+        let unrelated: Error = AlienError::new(ErrorData::GenericError {
+            message: "Operation failed: UserErrorDiskNotFound".to_string(),
+        });
+        assert!(!is_missing_permissions_error(&unrelated));
+    }
+
+    #[tokio::test]
+    async fn missing_backup_instance_maps_to_not_found() {
+        let server = MockServer::start_async().await;
+        server
+            .mock_async(|when, then| {
+                when.method(GET)
+                    .path(format!("{VAULT_PATH}/backupInstances/stack-db-disk-0"));
+                then.status(404).json_body(json!({
+                    "error": {"code": "ResourceNotFound", "message": "not found"}
+                }));
+            })
+            .await;
+        let error = test_client(&server)
+            .get_backup_instance("rg", "stack-db-backups", "stack-db-disk-0")
+            .await
+            .expect_err("instance is missing");
+        assert!(matches!(
+            error.error,
+            Some(ErrorData::RemoteResourceNotFound { .. })
+        ));
+    }
+
+    #[tokio::test]
+    async fn suspend_resume_and_delete_instance_hit_documented_routes() {
+        let server = MockServer::start_async().await;
+        let suspend = server
+            .mock_async(|when, then| {
+                when.method(POST)
+                    .path(format!("{VAULT_PATH}/backupInstances/stack-db-disk-0/suspendBackups"))
+                    .query_param("api-version", "2026-07-01");
+                then.status(202).header(
+                    "Location",
+                    "https://management.azure.com/subscriptions/s/providers/Microsoft.DataProtection/locations/eastus/operationResults/op3",
+                );
+            })
+            .await;
+        let delete = server
+            .mock_async(|when, then| {
+                when.method(DELETE)
+                    .path(format!("{VAULT_PATH}/backupInstances/stack-db-disk-0"))
+                    .query_param("api-version", "2026-07-01");
+                then.status(204);
+            })
+            .await;
+        let resume = server
+            .mock_async(|when, then| {
+                when.method(POST)
+                    .path(format!(
+                        "{VAULT_PATH}/backupInstances/stack-db-disk-0/resumeBackups"
+                    ))
+                    .query_param("api-version", "2026-07-01");
+                then.status(200).json_body(json!({}));
+            })
+            .await;
+        let client = test_client(&server);
+        let resumed = client
+            .resume_backups("rg", "stack-db-backups", "stack-db-disk-0")
+            .await
+            .expect("resume");
+        assert!(matches!(resumed, OperationResult::Completed(())));
+        resume.assert_async().await;
+        let suspended = client
+            .suspend_backups("rg", "stack-db-backups", "stack-db-disk-0")
+            .await
+            .expect("suspend");
+        assert!(matches!(suspended, OperationResult::LongRunning(_)));
+        let deleted = client
+            .delete_backup_instance("rg", "stack-db-backups", "stack-db-disk-0")
+            .await
+            .expect("delete");
+        assert!(matches!(deleted, OperationResult::Completed(())));
+        suspend.assert_async().await;
+        delete.assert_async().await;
+    }
+}
diff --git a/crates/alien-azure-clients/src/azure/mod.rs b/crates/alien-azure-clients/src/azure/mod.rs
index b68da038c8..863d450cef 100644
--- a/crates/alien-azure-clients/src/azure/mod.rs
+++ b/crates/alien-azure-clients/src/azure/mod.rs
@@ -17,6 +17,7 @@ pub mod common;
 pub mod compute;
 pub mod container_apps;
 pub mod containerregistry;
+pub mod data_protection;
 pub mod disks;
 pub mod event_grid;
 pub mod flexible_server;
@@ -35,6 +36,7 @@ pub mod resources;
 pub mod sandbox_data_plane;
 pub mod sandbox_groups;
 pub mod service_bus;
+pub mod snapshots;
 pub mod storage_accounts;
 pub mod tables;
 pub mod token_cache;
diff --git a/crates/alien-azure-clients/src/azure/snapshots.rs b/crates/alien-azure-clients/src/azure/snapshots.rs
new file mode 100644
index 0000000000..2451c7ffee
--- /dev/null
+++ b/crates/alien-azure-clients/src/azure/snapshots.rs
@@ -0,0 +1,494 @@
+//! Azure managed disk snapshots (`Microsoft.Compute/snapshots`).
+//!
+//! Incremental snapshots record only the changes since the previous snapshot of the same disk,
+//! are billed for used size, and can be turned back into a full disk with
+//! `creationData.createOption = Copy`. Snapshots of Standard HDD, Standard SSD and Premium SSD
+//! disks can be used as soon as they are created.
+//!
+//! https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots
+//! https://learn.microsoft.com/en-us/rest/api/compute/snapshots
+
+use crate::azure::common::{AzureClientBase, AzureRequestBuilder};
+use crate::azure::long_running_operation::OperationResult;
+use crate::azure::token_cache::AzureTokenCache;
+use alien_client_core::{ErrorData, Result};
+use alien_error::{Context, IntoAlienError};
+use reqwest::{Client, Method};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+#[cfg(feature = "test-utils")]
+use mockall::automock;
+
+const MANAGEMENT_SCOPE: &str = "https://management.azure.com/.default";
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct Snapshot {
+    pub location: String,
+    #[serde(default, skip_serializing_if = "HashMap::is_empty")]
+    pub tags: HashMap<String, String>,
+    pub properties: SnapshotProperties,
+    /// ARM resource ID (response only).
+    #[serde(default, skip_serializing)]
+    pub id: Option<String>,
+    /// Snapshot name (response only).
+    #[serde(default, skip_serializing)]
+    pub name: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct SnapshotProperties {
+    pub creation_data: SnapshotCreationData,
+    /// Request an incremental snapshot.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub incremental: Option<bool>,
+    /// Size of the source disk when the snapshot was taken (response only).
+    #[serde(rename = "diskSizeGB", default, skip_serializing)]
+    pub disk_size_gb: Option<i64>,
+    /// When the snapshot was taken, RFC 3339 (response only).
+    #[serde(default, skip_serializing)]
+    pub time_created: Option<String>,
+    /// "Creating", "Succeeded", "Failed", ... (response only).
+    #[serde(default, skip_serializing)]
+    pub provisioning_state: Option<String>,
+    /// Background copy progress. Only Premium SSD v2 and Ultra Disk snapshots report less than
+    /// 100 (response only).
+    #[serde(default, skip_serializing)]
+    pub completion_percent: Option<f64>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct SnapshotCreationData {
+    /// "Copy" to snapshot an existing disk.
+    pub create_option: String,
+    /// ARM ID of the source disk.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub source_resource_id: Option<String>,
+    /// Unique ID of the source disk (response only). Changes when a disk is deleted and
+    /// recreated under the same name.
+    #[serde(default, skip_serializing)]
+    pub source_unique_id: Option<String>,
+}
+
+impl Snapshot {
+    /// An incremental snapshot of `disk_id`.
+    pub fn incremental_copy_of(
+        disk_id: &str,
+        location: &str,
+        tags: HashMap<String, String>,
+    ) -> Self {
+        Snapshot {
+            location: location.to_string(),
+            tags,
+            properties: SnapshotProperties {
+                creation_data: SnapshotCreationData {
+                    create_option: "Copy".to_string(),
+                    source_resource_id: Some(disk_id.to_string()),
+                    source_unique_id: None,
+                },
+                incremental: Some(true),
+                disk_size_gb: None,
+                time_created: None,
+                provisioning_state: None,
+                completion_percent: None,
+            },
+            id: None,
+            name: None,
+        }
+    }
+
+    /// Whether the snapshot finished provisioning and its data copy is complete, so a disk can
+    /// be created from it and its source disk can go away.
+    pub fn is_ready(&self) -> bool {
+        self.properties.provisioning_state.as_deref() == Some("Succeeded")
+            && self
+                .properties
+                .completion_percent
+                .is_none_or(|percent| percent >= 100.0)
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SnapshotList {
+    #[serde(default)]
+    value: Vec<Snapshot>,
+    #[serde(default)]
+    next_link: Option<String>,
+}
+
+pub type SnapshotOperationResult = OperationResult<Snapshot>;
+
+#[cfg_attr(feature = "test-utils", automock)]
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+pub trait SnapshotsApi: Send + Sync + std::fmt::Debug {
+    /// Creates or updates a snapshot. Long-running.
+    async fn create_or_update_snapshot(
+        &self,
+        resource_group: &str,
+        snapshot_name: &str,
+        snapshot: &Snapshot,
+    ) -> Result<SnapshotOperationResult>;
+
+    async fn get_snapshot(&self, resource_group: &str, snapshot_name: &str) -> Result<Snapshot>;
+
+    /// Lists every snapshot in a resource group, following `nextLink` pages.
+    async fn list_snapshots(&self, resource_group: &str) -> Result<Vec<Snapshot>>;
+
+    /// Deletes a snapshot. Long-running.
+    async fn delete_snapshot(
+        &self,
+        resource_group: &str,
+        snapshot_name: &str,
+    ) -> Result<OperationResult<()>>;
+}
+
+#[derive(Debug)]
+pub struct AzureSnapshotsClient {
+    pub base: AzureClientBase,
+    pub token_cache: AzureTokenCache,
+}
+
+impl AzureSnapshotsClient {
+    /// Same Compute disk resource provider version as the managed disks client.
+    const API_VERSION: &'static str = "2024-03-02";
+
+    /// Follows a `nextLink` only on the management endpoint, so the bearer token is never sent
+    /// to another host.
+    fn same_origin_next_link(&self, link: String, resource_group: &str) -> Result<String> {
+        let endpoint = url::Url::parse(&self.base.build_url("", None))
+            .into_alien_error()
+            .context(ErrorData::InvalidClientConfig {
+                message: "Azure management endpoint is not a valid URL".to_string(),
+                errors: None,
+            })?;
+        let next = url::Url::parse(&link)
+            .into_alien_error()
+            .context(ErrorData::InvalidInput {
+                message: format!(
+                    "Azure ListSnapshots for {resource_group} returned an invalid nextLink"
+                ),
+                field_name: Some("nextLink".to_string()),
+            })?;
+        if next.origin() != endpoint.origin() {
+            return Err(alien_error::AlienError::new(ErrorData::InvalidInput {
+                message: format!(
+                    "Azure ListSnapshots for {resource_group} returned a nextLink on another host: {}",
+                    next.origin().ascii_serialization()
+                ),
+                field_name: Some("nextLink".to_string()),
+            }));
+        }
+        Ok(link)
+    }
+
+    pub fn new(client: Client, token_cache: AzureTokenCache) -> Self {
+        let endpoint = token_cache.management_endpoint().to_string();
+        Self {
+            base: AzureClientBase::with_client_config(
+                client,
+                endpoint,
+                token_cache.config().clone(),
+            ),
+            token_cache,
+        }
+    }
+
+    fn snapshots_path(&self, resource_group: &str) -> String {
+        format!(
+            "/subscriptions/{}/resourceGroups/{}/providers/Microsoft.Compute/snapshots",
+            self.token_cache.config().subscription_id,
+            resource_group
+        )
+    }
+
+    fn snapshot_url(&self, resource_group: &str, snapshot_name: &str) -> String {
+        self.base.build_url(
+            &format!("{}/{}", self.snapshots_path(resource_group), snapshot_name),
+            Some(vec![("api-version", Self::API_VERSION.into())]),
+        )
+    }
+
+    async fn read_body(resp: reqwest::Response, op: &str, name: &str) -> Result<String> {
+        resp.text()
+            .await
+            .into_alien_error()
+            .context(ErrorData::SerializationError {
+                message: format!("Azure {op}: failed to read body for {name}"),
+            })
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+impl SnapshotsApi for AzureSnapshotsClient {
+    async fn create_or_update_snapshot(
+        &self,
+        resource_group: &str,
+        snapshot_name: &str,
+        snapshot: &Snapshot,
+    ) -> Result<SnapshotOperationResult> {
+        let token = self
+            .token_cache
+            .get_bearer_token_with_scope(MANAGEMENT_SCOPE)
+            .await?;
+        let body = serde_json::to_string(snapshot).into_alien_error().context(
+            ErrorData::SerializationError {
+                message: format!("Failed to serialize snapshot {snapshot_name}"),
+            },
+        )?;
+        let req = AzureRequestBuilder::new(
+            Method::PUT,
+            self.snapshot_url(resource_group, snapshot_name),
+        )
+        .content_type_json()
+        .content_length(&body)
+        .body(body)
+        .build()?;
+        let signed = self.base.sign_request(req, &token).await?;
+        self.base
+            .execute_request_with_long_running_support(
+                signed,
+                "CreateOrUpdateSnapshot",
+                snapshot_name,
+            )
+            .await
+    }
+
+    async fn get_snapshot(&self, resource_group: &str, snapshot_name: &str) -> Result<Snapshot> {
+        let token = self
+            .token_cache
+            .get_bearer_token_with_scope(MANAGEMENT_SCOPE)
+            .await?;
+        let req = AzureRequestBuilder::new(
+            Method::GET,
+            self.snapshot_url(resource_group, snapshot_name),
+        )
+        .content_length("")
+        .build()?;
+        let signed = self.base.sign_request(req, &token).await?;
+        let resp = self
+            .base
+            .execute_request(signed, "GetSnapshot", snapshot_name)
+            .await?;
+        let body = Self::read_body(resp, "GetSnapshot", snapshot_name).await?;
+        serde_json::from_str(&body)
+            .into_alien_error()
+            .context(ErrorData::SerializationError {
+                message: format!("Azure GetSnapshot: JSON parse error for {snapshot_name}"),
+            })
+    }
+
+    async fn list_snapshots(&self, resource_group: &str) -> Result<Vec<Snapshot>> {
+        let token = self
+            .token_cache
+            .get_bearer_token_with_scope(MANAGEMENT_SCOPE)
+            .await?;
+        let mut snapshots = Vec::new();
+        let mut next_url = Some(self.base.build_url(
+            &self.snapshots_path(resource_group),
+            Some(vec![("api-version", Self::API_VERSION.into())]),
+        ));
+        while let Some(url) = next_url.take() {
+            let req = AzureRequestBuilder::new(Method::GET, url)
+                .content_length("")
+                .build()?;
+            let signed = self.base.sign_request(req, &token).await?;
+            let resp = self
+                .base
+                .execute_request(signed, "ListSnapshots", resource_group)
+                .await?;
+            let body = Self::read_body(resp, "ListSnapshots", resource_group).await?;
+            let page: SnapshotList = serde_json::from_str(&body).into_alien_error().context(
+                ErrorData::SerializationError {
+                    message: format!("Azure ListSnapshots: JSON parse error for {resource_group}"),
+                },
+            )?;
+            snapshots.extend(page.value);
+            next_url = page
+                .next_link
+                .map(|link| self.same_origin_next_link(link, resource_group))
+                .transpose()?;
+        }
+        Ok(snapshots)
+    }
+
+    async fn delete_snapshot(
+        &self,
+        resource_group: &str,
+        snapshot_name: &str,
+    ) -> Result<OperationResult<()>> {
+        let token = self
+            .token_cache
+            .get_bearer_token_with_scope(MANAGEMENT_SCOPE)
+            .await?;
+        let req = AzureRequestBuilder::new(
+            Method::DELETE,
+            self.snapshot_url(resource_group, snapshot_name),
+        )
+        .content_length("")
+        .build()?;
+        let signed = self.base.sign_request(req, &token).await?;
+        self.base
+            .execute_request_with_long_running_support(signed, "DeleteSnapshot", snapshot_name)
+            .await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+
+    use httpmock::{Method::GET, Method::PUT, MockServer};
+    use serde_json::json;
+
+    use super::*;
+    use crate::azure::{AzureClientConfig, AzureClientConfigExt, ServiceOverrides};
+
+    const SNAPSHOTS_PATH: &str = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg/providers/Microsoft.Compute/snapshots";
+
+    fn test_client(server: &MockServer) -> AzureSnapshotsClient {
+        let config = AzureClientConfig::mock().with_service_overrides(ServiceOverrides {
+            endpoints: HashMap::from([("management".to_string(), server.base_url())]),
+        });
+        AzureSnapshotsClient::new(Client::new(), AzureTokenCache::new(config))
+    }
+
+    #[tokio::test]
+    async fn creates_incremental_copy_with_tags() {
+        let server = MockServer::start_async().await;
+        let disk_id = "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg/providers/Microsoft.Compute/disks/stack-db-disk-0";
+        let mock = server
+            .mock_async(|when, then| {
+                when.method(PUT)
+                    .path(format!("{SNAPSHOTS_PATH}/stack-db-disk-0-final"))
+                    .query_param("api-version", "2024-03-02")
+                    .json_body(json!({
+                        "location": "eastus",
+                        "tags": {"alien-snapshot-kind": "final"},
+                        "properties": {
+                            "creationData": {"createOption": "Copy", "sourceResourceId": disk_id},
+                            "incremental": true
+                        }
+                    }));
+                then.status(202).header(
+                    "Azure-AsyncOperation",
+                    "https://management.azure.com/subscriptions/s/providers/Microsoft.Compute/locations/eastus/operations/op1",
+                );
+            })
+            .await;
+        let snapshot = Snapshot::incremental_copy_of(
+            disk_id,
+            "eastus",
+            HashMap::from([("alien-snapshot-kind".to_string(), "final".to_string())]),
+        );
+        let result = test_client(&server)
+            .create_or_update_snapshot("rg", "stack-db-disk-0-final", &snapshot)
+            .await
+            .expect("snapshot create");
+        mock.assert_async().await;
+        assert!(matches!(result, OperationResult::LongRunning(_)));
+    }
+
+    #[tokio::test]
+    async fn list_follows_next_link_pages() {
+        let server = MockServer::start_async().await;
+        let next_link = format!(
+            "{}{SNAPSHOTS_PATH}?api-version=2024-03-02&$skiptoken=page2",
+            server.base_url()
+        );
+        // Registered first: httpmock serves the first matching mock, and only the second page
+        // request carries the skip token.
+        let second = server
+            .mock_async(|when, then| {
+                when.method(GET)
+                    .path(SNAPSHOTS_PATH)
+                    .query_param("$skiptoken", "page2");
+                then.status(200).json_body(json!({
+                    "value": [{
+                        "name": "b",
+                        "location": "eastus",
+                        "properties": {
+                            "creationData": {"createOption": "Copy", "sourceResourceId": "disk-b"},
+                            "provisioningState": "Creating"
+                        }
+                    }]
+                }));
+            })
+            .await;
+
+        let first = server
+            .mock_async(|when, then| {
+                when.method(GET)
+                    .path(SNAPSHOTS_PATH)
+                    .query_param("api-version", "2024-03-02");
+                then.status(200).json_body(json!({
+                    "value": [{
+                        "name": "a",
+                        "location": "eastus",
+                        "properties": {
+                            "creationData": {"createOption": "Copy", "sourceResourceId": "disk-a"},
+                            "provisioningState": "Succeeded",
+                            "timeCreated": "2026-10-01T00:00:00Z",
+                            "diskSizeGB": 10
+                        }
+                    }],
+                    "nextLink": next_link
+                }));
+            })
+            .await;
+        let snapshots = test_client(&server)
+            .list_snapshots("rg")
+            .await
+            .expect("list");
+        first.assert_async().await;
+        second.assert_async().await;
+        let names: Vec<_> = snapshots.iter().filter_map(|s| s.name.as_deref()).collect();
+        assert_eq!(names, ["a", "b"]);
+        assert!(snapshots[0].is_ready());
+        assert_eq!(snapshots[0].properties.disk_size_gb, Some(10));
+        assert!(!snapshots[1].is_ready());
+    }
+
+    #[tokio::test]
+    async fn list_refuses_a_next_link_on_another_host() {
+        let server = MockServer::start_async().await;
+        let other = MockServer::start_async().await;
+        let leaked = other
+            .mock_async(|when, then| {
+                when.any_request();
+                then.status(200).json_body(json!({ "value": [] }));
+            })
+            .await;
+        server
+            .mock_async(|when, then| {
+                when.method(GET).path(SNAPSHOTS_PATH);
+                then.status(200).json_body(json!({
+                    "value": [],
+                    "nextLink": format!("{}{SNAPSHOTS_PATH}?$skiptoken=page2", other.base_url())
+                }));
+            })
+            .await;
+
+        let error = test_client(&server)
+            .list_snapshots("rg")
+            .await
+            .expect_err("a nextLink on another host must not be followed");
+        assert!(error.to_string().contains("another host"), "{error}");
+        leaked.assert_hits_async(0).await;
+    }
+
+    #[test]
+    fn snapshot_is_not_ready_until_background_copy_completes() {
+        let mut snapshot = Snapshot::incremental_copy_of("disk", "eastus", HashMap::new());
+        snapshot.properties.provisioning_state = Some("Succeeded".to_string());
+        snapshot.properties.completion_percent = Some(42.0);
+        assert!(!snapshot.is_ready());
+        snapshot.properties.completion_percent = Some(100.0);
+        assert!(snapshot.is_ready());
+    }
+}
diff --git a/crates/alien-azure-clients/src/lib.rs b/crates/alien-azure-clients/src/lib.rs
index 7f23409e32..1c837536a3 100644
--- a/crates/alien-azure-clients/src/lib.rs
+++ b/crates/alien-azure-clients/src/lib.rs
@@ -15,6 +15,7 @@ pub use azure::cognitive_services::{AzureCognitiveServicesClient, CognitiveServi
 pub use azure::compute::{AzureVmssClient, VirtualMachineScaleSetsApi};
 pub use azure::container_apps::{AzureContainerAppsClient, ContainerAppsApi};
 pub use azure::containerregistry::{AzureContainerRegistryClient, ContainerRegistryApi};
+pub use azure::data_protection::{AzureDataProtectionClient, DataProtectionApi};
 pub use azure::disks::{AzureManagedDisksClient, ManagedDisksApi};
 pub use azure::event_grid::{AzureEventGridClient, EventGridApi};
 pub use azure::flexible_server::{AzureFlexibleServerClient, FlexibleServerApi};
@@ -41,6 +42,7 @@ pub use azure::service_bus::{
     AzureServiceBusDataPlaneClient, AzureServiceBusManagementClient, ServiceBusDataPlaneApi,
     ServiceBusManagementApi,
 };
+pub use azure::snapshots::{AzureSnapshotsClient, SnapshotsApi};
 pub use azure::storage_accounts::{AzureStorageAccountsClient, StorageAccountsApi};
 pub use azure::tables::{
     AzureTableManagementClient, AzureTableStorageClient, TableManagementApi, TableStorageApi,
diff --git a/crates/alien-cli/src/commands/deployments.rs b/crates/alien-cli/src/commands/deployments.rs
index 0a04b563bf..2576c35200 100644
--- a/crates/alien-cli/src/commands/deployments.rs
+++ b/crates/alien-cli/src/commands/deployments.rs
@@ -25,6 +25,7 @@ use alien_platform_api::types::{
     DeploymentUpdateOperationSummaryInner, GetDeploymentId, GetDeploymentWorkspace,
     ListDeploymentsIncludeItem, NewDeploymentRequest, PinDeploymentReleaseId,
     PinDeploymentReleaseWorkspace, PinReleaseRequest, PinReleaseRequestReleaseId,
+    CreateVolumeRestoreRequest, VolumeRestore,
 };
 use alien_platform_api::SdkResultExt as _;
 use clap::{Parser, Subcommand, ValueEnum};
@@ -121,6 +122,9 @@ impl DeploymentsArgs {
                 | DeploymentsCmd::Events { json: true, .. }
                 | DeploymentsCmd::Wait { json: true, .. }
                 | DeploymentsCmd::Machines { json: true, .. }
+                | DeploymentsCmd::Volumes { json: true, .. }
+                | DeploymentsCmd::RestoreVolume { json: true, .. }
+                | DeploymentsCmd::CancelVolumeRestore { json: true, .. }
                 | DeploymentsCmd::Retry { json: true, .. }
                 | DeploymentsCmd::Redeploy { json: true, .. }
                 | DeploymentsCmd::Pin { json: true, .. }
@@ -264,6 +268,59 @@ pub enum DeploymentsCmd {
         #[arg(long)]
         json: bool,
     },
+    /// Show container volumes, their latest snapshots and restores
+    Volumes {
+        /// Deployment ID, or <deployment-group-name>/<deployment-name>
+        id: String,
+
+        /// Print machine-readable JSON
+        #[arg(long)]
+        json: bool,
+    },
+    /// Replace a replica's persistent volume with a volume made from a snapshot
+    ///
+    /// The replica is stopped while its volume is swapped. The replaced volume is
+    /// snapshotted before it is deleted, so the restore can be undone by restoring
+    /// that snapshot.
+    RestoreVolume {
+        /// Deployment ID, or <deployment-group-name>/<deployment-name>
+        id: String,
+
+        /// Container resource that owns the volume
+        #[arg(long)]
+        resource: String,
+
+        /// Replica ordinal whose volume is replaced
+        #[arg(long)]
+        ordinal: u32,
+
+        /// Snapshot to restore, as shown by `alien deployments volumes`
+        #[arg(long)]
+        snapshot: String,
+
+        /// Skip confirmation prompt
+        #[arg(long)]
+        yes: bool,
+
+        /// Print the restore request as machine-readable JSON
+        #[arg(long)]
+        json: bool,
+    },
+    /// Cancel a pending volume restore
+    ///
+    /// Use it when a restore keeps failing. A restore whose volume was already
+    /// swapped still finishes.
+    CancelVolumeRestore {
+        /// Deployment ID, or <deployment-group-name>/<deployment-name>
+        id: String,
+
+        /// Restore request ID, as shown by `alien deployments volumes`
+        request_id: String,
+
+        /// Print the cancelled request as machine-readable JSON
+        #[arg(long)]
+        json: bool,
+    },
     /// Delete a deployment
     Delete {
         /// Deployment ID, or <deployment-group-name>/<deployment-name>
@@ -482,6 +539,93 @@ pub async fn deployments_task(args: DeploymentsArgs, ctx: ExecutionMode) -> Resu
             )
             .await
         }
+        DeploymentsCmd::Volumes { id, json } => {
+            #[cfg(feature = "platform")]
+            if ctx.is_platform() {
+                let workspace = ctx.resolve_workspace_with_bootstrap(!json).await?;
+                let resolved = crate::platform_deployment_resolver::resolve_with_manager(
+                    &ctx, &id, None, !json,
+                )
+                .await?;
+                let deployment_id = String::from(resolved.detail.id);
+                let deployment =
+                    resolve_deployment_reference(&resolved.manager.client, &deployment_id).await?;
+                let client = ctx.sdk_client().await?;
+                let restores = list_platform_volume_restores(
+                    &client,
+                    workspace.as_str(),
+                    &deployment_id,
+                )
+                .await?;
+                return volumes_task(&deployment, Some(restores), json);
+            }
+            let manager = resolve_manager_client(&ctx, None, !json).await?;
+            let deployment = resolve_deployment_reference(&manager, &id).await?;
+            volumes_task(&deployment, None, json)
+        }
+        DeploymentsCmd::RestoreVolume {
+            id,
+            resource,
+            ordinal,
+            snapshot,
+            yes,
+            json,
+        } => {
+            if !ctx.is_platform() {
+                return Err(AlienError::new(ErrorData::ValidationError {
+                    field: "command".to_string(),
+                    message: "Volume restores are available on Alien Platform deployments."
+                        .to_string(),
+                }));
+            }
+            let confirmation_mode = restore_confirmation_mode(yes, json)?;
+            let workspace = ctx.resolve_workspace_with_bootstrap(!json).await?;
+            let client = ctx.sdk_client().await?;
+            let deployment = crate::platform_deployment_resolver::resolve(
+                &ctx, &client, &workspace, &id, None, !json,
+            )
+            .await?;
+            restore_volume_task(
+                &client,
+                workspace.as_str(),
+                &deployment,
+                VolumeRestoreTarget {
+                    resource,
+                    ordinal,
+                    snapshot,
+                },
+                confirmation_mode,
+                json,
+            )
+            .await
+        }
+        DeploymentsCmd::CancelVolumeRestore {
+            id,
+            request_id,
+            json,
+        } => {
+            if !ctx.is_platform() {
+                return Err(AlienError::new(ErrorData::ValidationError {
+                    field: "command".to_string(),
+                    message: "Volume restores are available on Alien Platform deployments."
+                        .to_string(),
+                }));
+            }
+            let workspace = ctx.resolve_workspace_with_bootstrap(!json).await?;
+            let client = ctx.sdk_client().await?;
+            let deployment = crate::platform_deployment_resolver::resolve(
+                &ctx, &client, &workspace, &id, None, !json,
+            )
+            .await?;
+            cancel_volume_restore_task(
+                &client,
+                workspace.as_str(),
+                &String::from(deployment.id),
+                &request_id,
+                json,
+            )
+            .await
+        }
         DeploymentsCmd::Delete { id, forget, yes } => {
             let action = if forget {
                 DeleteDeploymentAction::Forget
@@ -2005,6 +2149,290 @@ fn resource_summaries(stack_state: alien_core::StackState) -> Vec<ResourceSummar
     summaries
 }
 
+#[derive(Debug, Clone)]
+struct VolumeRestoreTarget {
+    resource: String,
+    ordinal: u32,
+    snapshot: String,
+}
+
+fn restore_confirmation_mode(yes: bool, json: bool) -> Result<ConfirmationMode> {
+    InteractionMode::current(json).confirmation_mode(
+        yes,
+        "Restoring a volume replaces a replica's data and needs confirmation. Re-run with `--yes`.",
+    )
+}
+
+async fn restore_volume_task(
+    client: &alien_platform_api::Client,
+    workspace: &str,
+    deployment: &DeploymentDetailResponse,
+    target: VolumeRestoreTarget,
+    confirmation_mode: ConfirmationMode,
+    json: bool,
+) -> Result<()> {
+    let deployment_id = String::from(deployment.id.clone());
+    if !json {
+        println!(
+            "{}",
+            contextual_heading("Restoring volume", &deployment.name, &[])
+        );
+        println!("{} {}", dim_label("ID"), deployment_id);
+        println!("{} {}", dim_label("Resource"), target.resource);
+        println!("{} {}", dim_label("Replica"), target.ordinal);
+        println!("{} {}", dim_label("Snapshot"), target.snapshot);
+        println!(
+            "{}",
+            dim_label(
+                "The replica is stopped while its volume is swapped. Its current volume is snapshotted before it is deleted."
+            )
+        );
+    }
+    if matches!(confirmation_mode, ConfirmationMode::Prompt)
+        && !prompt_confirm("Replace this replica's volume?", false)?
+    {
+        println!("{}", dim_label("Restore cancelled."));
+        return Ok(());
+    }
+
+    let body = CreateVolumeRestoreRequest {
+        resource_id: target.resource.as_str().try_into().map_err(|_| {
+            AlienError::new(ErrorData::ValidationError {
+                field: "resource".to_string(),
+                message: "Resource IDs are 1 to 64 characters.".to_string(),
+            })
+        })?,
+        ordinal: target.ordinal.into(),
+        snapshot_id: target.snapshot.as_str().try_into().map_err(|_| {
+            AlienError::new(ErrorData::ValidationError {
+                field: "snapshot".to_string(),
+                message: "Snapshot IDs are 1 to 1024 characters.".to_string(),
+            })
+        })?,
+    };
+    let restore = client
+        .create_deployment_volume_restore()
+        .id(deployment_id.as_str())
+        .workspace(workspace)
+        .body(body)
+        .send()
+        .await
+        .into_sdk_error()
+        .context(ErrorData::ApiRequestFailed {
+            message: format!("requesting a volume restore for deployment '{deployment_id}'"),
+            url: None,
+        })?
+        .into_inner();
+
+    if json {
+        return print_json(&restore);
+    }
+    println!("{}", success_line("Volume restore requested."));
+    println!("{} {}", dim_label("Request"), String::from(restore.id));
+    println!(
+        "{} {}",
+        dim_label("Next"),
+        command(&format!("alien deployments volumes {deployment_id}"))
+    );
+    Ok(())
+}
+
+async fn cancel_volume_restore_task(
+    client: &alien_platform_api::Client,
+    workspace: &str,
+    deployment_id: &str,
+    request_id: &str,
+    json: bool,
+) -> Result<()> {
+    let cancelled = client
+        .cancel_deployment_volume_restore()
+        .id(deployment_id)
+        .request_id(request_id)
+        .workspace(workspace)
+        .send()
+        .await
+        .into_sdk_error()
+        .context(ErrorData::ApiRequestFailed {
+            message: format!(
+                "cancelling volume restore '{request_id}' of deployment '{deployment_id}'"
+            ),
+            url: None,
+        })?
+        .into_inner();
+
+    if json {
+        return print_json(&cancelled);
+    }
+    println!("{}", success_line("Volume restore cancelled."));
+    println!(
+        "{}",
+        dim_label("If the deployment failed on this restore, retry it to bring it back to running.")
+    );
+    println!(
+        "{} {}",
+        dim_label("Next"),
+        command(&format!("alien deployments retry {deployment_id}"))
+    );
+    Ok(())
+}
+
+async fn list_platform_volume_restores(
+    client: &alien_platform_api::Client,
+    workspace: &str,
+    deployment_id: &str,
+) -> Result<Vec<VolumeRestore>> {
+    Ok(client
+        .list_deployment_volume_restores()
+        .id(deployment_id)
+        .workspace(workspace)
+        .send()
+        .await
+        .into_sdk_error()
+        .context(ErrorData::ApiRequestFailed {
+            message: format!("listing volume restores for deployment '{deployment_id}'"),
+            url: None,
+        })?
+        .into_inner()
+        .items)
+}
+
+#[derive(Debug, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+struct VolumeSummary {
+    resource: String,
+    ordinal: u32,
+    volume_id: String,
+    zone: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    last_snapshot_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    last_snapshot_at: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    last_restore: Option<alien_core::VolumeRestoreOutput>,
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct VolumesOutput {
+    volumes: Vec<VolumeSummary>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    restores: Option<Vec<VolumeRestore>>,
+}
+
+fn volumes_task(
+    deployment: &DeploymentResponse,
+    restores: Option<Vec<VolumeRestore>>,
+    json: bool,
+) -> Result<()> {
+    let volumes = deployment
+        .stack_state
+        .as_ref()
+        .map(|value| {
+            serde_json::from_value::<alien_core::StackState>(value.clone())
+                .into_alien_error()
+                .context(ErrorData::JsonError {
+                    operation: "deserialization".to_string(),
+                    reason: "Failed to inspect deployment volumes".to_string(),
+                })
+                .map(volume_summaries)
+        })
+        .transpose()?
+        .unwrap_or_default();
+
+    if json {
+        return print_json(&VolumesOutput { volumes, restores });
+    }
+
+    if volumes.is_empty() {
+        println!(
+            "{}",
+            dim_label("No containers with persistent storage have reported volumes yet.")
+        );
+    } else {
+        let mut table = make_table(&[
+            "Resource",
+            "Replica",
+            "Volume",
+            "Zone",
+            "Latest snapshot",
+            "Snapshot time",
+        ]);
+        for volume in &volumes {
+            table.add_row(vec![
+                volume.resource.clone(),
+                volume.ordinal.to_string(),
+                volume.volume_id.clone(),
+                volume.zone.clone(),
+                volume
+                    .last_snapshot_id
+                    .clone()
+                    .unwrap_or_else(|| "—".to_string()),
+                volume
+                    .last_snapshot_at
+                    .clone()
+                    .unwrap_or_else(|| "—".to_string()),
+            ]);
+        }
+        print_table(table);
+    }
+
+    let Some(restores) = restores.filter(|restores| !restores.is_empty()) else {
+        return Ok(());
+    };
+    println!();
+    println!("{}", heading("Restores"));
+    let mut table = make_table(&[
+        "Request", "Resource", "Replica", "Snapshot", "Status", "Requested",
+    ]);
+    for restore in restores {
+        table.add_row(vec![
+            String::from(restore.id).into(),
+            restore.resource_id.into(),
+            restore.ordinal.to_string().into(),
+            restore.snapshot_id.into(),
+            status_cell(&restore.status.to_string()),
+            restore
+                .created_at
+                .format("%Y-%m-%d %H:%M UTC")
+                .to_string()
+                .into(),
+        ]);
+    }
+    print_table(table);
+    Ok(())
+}
+
+fn volume_summaries(stack_state: alien_core::StackState) -> Vec<VolumeSummary> {
+    let mut volumes: Vec<_> = stack_state
+        .resources
+        .iter()
+        .flat_map(|(name, resource)| {
+            resource
+                .outputs
+                .as_ref()
+                .and_then(|outputs| outputs.downcast_ref::<alien_core::ContainerOutputs>())
+                .map(|outputs| outputs.volumes.as_slice())
+                .unwrap_or_default()
+                .iter()
+                .map(move |volume| VolumeSummary {
+                    resource: name.clone(),
+                    ordinal: volume.ordinal,
+                    volume_id: volume.volume_id.clone(),
+                    zone: volume.zone.clone(),
+                    last_snapshot_id: volume.last_snapshot_id.clone(),
+                    last_snapshot_at: volume.last_snapshot_at.clone(),
+                    last_restore: volume.last_restore.clone(),
+                })
+        })
+        .collect();
+    volumes.sort_by(|left, right| {
+        left.resource
+            .cmp(&right.resource)
+            .then(left.ordinal.cmp(&right.ordinal))
+    });
+    volumes
+}
+
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct DeploymentWaitOutput {
@@ -3286,6 +3714,140 @@ mod tests {
         );
     }
 
+    #[test]
+    fn volume_restore_commands_parse_in_their_documented_form() {
+        let restore = DeploymentsArgs::try_parse_from([
+            "deployments",
+            "restore-volume",
+            "production/db",
+            "--resource",
+            "postgres",
+            "--ordinal",
+            "1",
+            "--snapshot",
+            "snap-0123",
+        ])
+        .expect("restore-volume should parse");
+        assert!(matches!(
+            restore.cmd,
+            DeploymentsCmd::RestoreVolume { ref resource, ordinal: 1, ref snapshot, yes: false, json: false, .. }
+                if resource == "postgres" && snapshot == "snap-0123"
+        ));
+
+        let cancel = DeploymentsArgs::try_parse_from([
+            "deployments",
+            "cancel-volume-restore",
+            "production/db",
+            "vrst_0123",
+            "--json",
+        ])
+        .expect("cancel-volume-restore should parse");
+        assert!(cancel.wants_json_output());
+        assert!(matches!(
+            cancel.cmd,
+            DeploymentsCmd::CancelVolumeRestore { ref request_id, json: true, .. }
+                if request_id == "vrst_0123"
+        ));
+    }
+
+    fn container_config(id: &str) -> serde_json::Value {
+        let container = alien_core::Container::new(id.to_string())
+            .cluster("compute".to_string())
+            .code(alien_core::ContainerCode::Image {
+                image: "postgres:16".to_string(),
+            })
+            .cpu(alien_core::ResourceSpec {
+                min: "1".to_string(),
+                desired: "1".to_string(),
+            })
+            .memory(alien_core::ResourceSpec {
+                min: "1Gi".to_string(),
+                desired: "1Gi".to_string(),
+            })
+            .permissions("execution".to_string())
+            .build();
+        serde_json::to_value(alien_core::Resource::new(container))
+            .expect("container config should serialize")
+    }
+
+    #[test]
+    fn volume_summaries_list_every_container_volume_in_order() {
+        let stack_state: alien_core::StackState = serde_json::from_value(serde_json::json!({
+            "platform": "aws",
+            "resourcePrefix": "test",
+            "resources": {
+                "web": {
+                    "type": "container",
+                    "status": "running",
+                    "config": container_config("web"),
+                    "outputs": {
+                        "type": "container",
+                        "name": "web",
+                        "status": "running",
+                        "currentReplicas": 1,
+                        "desiredReplicas": 1,
+                        "internalDns": "web.svc",
+                        "replicas": []
+                    }
+                },
+                "db": {
+                    "type": "container",
+                    "status": "running",
+                    "config": container_config("db"),
+                    "outputs": {
+                        "type": "container",
+                        "name": "db",
+                        "status": "running",
+                        "currentReplicas": 2,
+                        "desiredReplicas": 2,
+                        "internalDns": "db.svc",
+                        "replicas": [],
+                        "volumes": [
+                            { "ordinal": 1, "volumeId": "vol-1", "zone": "us-east-1b" },
+                            {
+                                "ordinal": 0,
+                                "volumeId": "vol-0",
+                                "zone": "us-east-1a",
+                                "lastSnapshotId": "snap-0",
+                                "lastSnapshotAt": "2026-10-05T00:00:00Z",
+                                "lastRestore": {
+                                    "requestId": "vrst_1",
+                                    "snapshotId": "snap-old",
+                                    "replacedVolumeSnapshotId": "snap-replaced",
+                                    "completedAt": "2026-10-04T00:00:00Z"
+                                }
+                            }
+                        ]
+                    }
+                },
+                "jobs": {
+                    "type": "queue",
+                    "status": "running",
+                    "config": { "type": "queue", "id": "jobs" }
+                }
+            }
+        }))
+        .expect("stack state should deserialize");
+
+        let volumes = volume_summaries(stack_state);
+        assert_eq!(
+            volumes
+                .iter()
+                .map(|volume| (volume.resource.as_str(), volume.ordinal, volume.volume_id.as_str()))
+                .collect::<Vec<_>>(),
+            vec![("db", 0, "vol-0"), ("db", 1, "vol-1")]
+        );
+        assert_eq!(volumes[0].last_snapshot_id.as_deref(), Some("snap-0"));
+        assert_eq!(
+            volumes[0]
+                .last_restore
+                .as_ref()
+                .map(|restore| restore.request_id.as_str()),
+            Some("vrst_1")
+        );
+        assert_eq!(volumes[1].last_snapshot_id, None);
+    }
+
     #[test]
     fn resource_summary_json_has_no_arbitrary_configuration_fields() {
         let summary = ResourceSummary {
diff --git a/crates/alien-cli/src/commands/event_display.rs b/crates/alien-cli/src/commands/event_display.rs
index 1b096c115f..31506f3b38 100644
--- a/crates/alien-cli/src/commands/event_display.rs
+++ b/crates/alien-cli/src/commands/event_display.rs
@@ -141,6 +141,7 @@ fn is_user_intent(data: &Value) -> bool {
                 | "DeploymentReleasePinned"
                 | "DeploymentReleaseUnpinned"
                 | "DeploymentEnvironmentUpdated"
+                | "DeploymentVolumeRestoreRequested"
                 | "DeploymentDeletionRequested"
         )
     )
@@ -159,6 +160,11 @@ fn event_title(data: &Value, state: &Value) -> String {
         ("DeploymentRedeployRequested", "failed") => "Redeployment Failed".to_string(),
         ("DeploymentRedeployRequested", "success") => "Deployment Redeployed".to_string(),
         ("DeploymentRedeployRequested", "started") => "Redeployment In Progress".to_string(),
+        ("DeploymentVolumeRestoreRequested", "failed") => "Volume Restore Failed".to_string(),
+        ("DeploymentVolumeRestoreRequested", "success") => "Volume Restore Applied".to_string(),
+        ("DeploymentVolumeRestoreRequested", "started") => {
+            "Volume Restore In Progress".to_string()
+        }
         ("DeploymentCreated", _) => "Deployment Created".to_string(),
         ("DeploymentReleased", _)
             if data.get("previousReleaseId").is_some_and(Value::is_string) =>
@@ -177,6 +183,7 @@ fn event_title(data: &Value, state: &Value) -> String {
         ("DeploymentReleasePinned", _) => "Release Pinned".to_string(),
         ("DeploymentReleaseUnpinned", _) => "Release Unpinned".to_string(),
         ("DeploymentEnvironmentUpdated", _) => "Configuration Update Requested".to_string(),
+        ("DeploymentVolumeRestoreRequested", _) => "Volume Restore Requested".to_string(),
         ("DeploymentDeletionRequested", _) => "Deployment Deletion Requested".to_string(),
         _ => humanize_event_type(event_type),
     }
@@ -223,6 +230,16 @@ fn event_details(data: &Value, state: &Value) -> String {
             (Some(previous), Some(current)) => format!("{previous} → {current}"),
             _ => String::new(),
         },
+        "DeploymentVolumeRestoreRequested" => match (
+            data.get("resourceId").and_then(Value::as_str),
+            data.get("ordinal").and_then(Value::as_u64),
+            data.get("snapshotId").and_then(Value::as_str),
+        ) {
+            (Some(resource), Some(ordinal), Some(snapshot)) => {
+                format!("{resource} replica {ordinal} from {snapshot}")
+            }
+            _ => String::new(),
+        },
         "DeploymentDeleted" => "Resources torn down".to_string(),
         "DeploymentDeletionRequested" => "Deletion enqueued".to_string(),
         _ => generic_event_details(data),
diff --git a/crates/alien-cli/src/commands/render.rs b/crates/alien-cli/src/commands/render.rs
index 1f69289841..eb003cf01c 100644
--- a/crates/alien-cli/src/commands/render.rs
+++ b/crates/alien-cli/src/commands/render.rs
@@ -181,6 +181,7 @@ async fn prepare_stack_for_render(
         manager_url: None,
         deployment_token: None,
         native_image_host: None,
+        volume_restores: Vec::new(),
     };
 
     runner
@@ -631,6 +632,7 @@ mod tests {
                     manager_url: None,
                     deployment_token: None,
                     native_image_host: None,
+                    volume_restores: Vec::new(),
                 };
                 let runner = alien_preflights::runner::PreflightRunner::new();
                 let on_gcp = runner
diff --git a/crates/alien-core/src/bin/schema_exporter.rs b/crates/alien-core/src/bin/schema_exporter.rs
index b6286a0d9f..c351b036cd 100644
--- a/crates/alien-core/src/bin/schema_exporter.rs
+++ b/crates/alien-core/src/bin/schema_exporter.rs
@@ -32,6 +32,11 @@ use utoipa::OpenApi;
     WorkerPublicEndpoint,
     PublicEndpointOutput,
     PersistentStorage,
+    VolumeBackups,
+    VolumeOutput,
+    VolumeRestoreOutput,
+    VolumeBackupsStatus,
+    VolumeBackupsState,
     KubernetesSecretMount,
     KubernetesHttpProbe,
     ContainerSecurity,
diff --git a/crates/alien-core/src/deployment/config.rs b/crates/alien-core/src/deployment/config.rs
index ef831ce004..65e35b659e 100644
--- a/crates/alien-core/src/deployment/config.rs
+++ b/crates/alien-core/src/deployment/config.rs
@@ -135,6 +135,34 @@ pub struct DeploymentConfig {
     /// - GAR: `{region}-docker.pkg.dev/{project_id}/{repository_name}`
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub native_image_host: Option<String>,
+    /// Operator requests to replace a replica's persistent volume with a new
+    /// volume made from a snapshot. A container controller performs each
+    /// request once, identified by its `request_id`, and reports it in
+    /// `ContainerOutputs.volumes`. Only a volume that a controller reports in
+    /// `ContainerOutputs.volumes` can be the target of a request.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    #[builder(default)]
+    pub volume_restores: Vec<VolumeRestoreRequest>,
+}
+
+/// Replace one replica's persistent volume with a new volume made from a snapshot.
+///
+/// The controller stops the replica, snapshots the volume it is about to
+/// replace (so the restore can be undone), creates the new volume in the same
+/// zone, starts the replica on it, and deletes the replaced volume.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct VolumeRestoreRequest {
+    /// Unique ID of this request. A controller performs each request once.
+    pub request_id: String,
+    /// ID of the container resource that owns the volume
+    pub resource_id: String,
+    /// Replica ordinal whose volume is replaced
+    pub ordinal: u32,
+    /// Cloud ID of the snapshot to restore: an EBS snapshot ID, a Compute
+    /// Engine snapshot name, or an Azure snapshot resource ID
+    pub snapshot_id: String,
 }
 
 /// Resource-attribute key marking OTLP telemetry as Alien system-component
diff --git a/crates/alien-core/src/resources/container.rs b/crates/alien-core/src/resources/container.rs
index 7407dd562f..4b985e3c7c 100644
--- a/crates/alien-core/src/resources/container.rs
+++ b/crates/alien-core/src/resources/container.rs
@@ -76,6 +76,110 @@ pub struct PersistentStorage {
     pub size: String,
     /// Mount path inside the container
     pub mount_path: String,
+    /// Scheduled snapshots of each replica's volume. On by default.
+    #[serde(default)]
+    pub backups: VolumeBackups,
+}
+
+/// Hours between snapshots that every cloud's native snapshot scheduler supports.
+pub const VOLUME_BACKUP_INTERVAL_HOURS: [u32; 7] = [1, 2, 4, 6, 8, 12, 24];
+
+/// Most snapshots a volume may hold at once. Azure Disk Backup keeps at most 450
+/// scheduled snapshots per disk; the same limit applies everywhere so a stack is
+/// portable across clouds.
+pub const VOLUME_BACKUP_MAX_SNAPSHOTS: u32 = 450;
+
+/// Longest a snapshot may be kept. Azure Disk Backup keeps operational snapshots
+/// for at most a year; the same limit applies everywhere for portability.
+pub const VOLUME_BACKUP_MAX_RETENTION_DAYS: u32 = 365;
+
+/// Scheduled snapshots of a persistent volume.
+///
+/// The cloud's own scheduler takes the snapshots (AWS Data Lifecycle Manager,
+/// a Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being
+/// taken while the deployment is unreachable. Snapshots are crash-consistent:
+/// the volume as it would be after a sudden power loss. When a container is
+/// deleted, Alien keeps one final snapshot of each volume.
+///
+/// Kubernetes deployments leave volume backups to the cluster's own tooling,
+/// and local deployments don't snapshot volumes. Neither reports volumes in
+/// `ContainerOutputs.volumes` or a `volumeBackups` status.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct VolumeBackups {
+    /// Whether snapshots are taken. Defaults to true.
+    #[serde(default = "default_volume_backups_enabled")]
+    pub enabled: bool,
+    /// Hours between snapshots: 1, 2, 4, 6, 8, 12 or 24. Defaults to 24.
+    #[serde(default = "default_volume_backup_interval_hours")]
+    pub interval_hours: u32,
+    /// Days each snapshot is kept, at most 365. Defaults to 7.
+    #[serde(default = "default_volume_backup_retention_days")]
+    pub retention_days: u32,
+}
+
+fn default_volume_backups_enabled() -> bool {
+    true
+}
+
+fn default_volume_backup_interval_hours() -> u32 {
+    24
+}
+
+fn default_volume_backup_retention_days() -> u32 {
+    7
+}
+
+impl Default for VolumeBackups {
+    fn default() -> Self {
+        Self {
+            enabled: default_volume_backups_enabled(),
+            interval_hours: default_volume_backup_interval_hours(),
+            retention_days: default_volume_backup_retention_days(),
+        }
+    }
+}
+
+impl VolumeBackups {
+    /// Backups switched off.
+    pub fn disabled() -> Self {
+        Self {
+            enabled: false,
+            ..Self::default()
+        }
+    }
+
+    /// Explains why this schedule can't run on every cloud, or `None` when it can.
+    pub fn validation_error(&self) -> Option<String> {
+        if !self.enabled {
+            return None;
+        }
+        if !VOLUME_BACKUP_INTERVAL_HOURS.contains(&self.interval_hours) {
+            return Some(format!(
+                "backup intervalHours must be one of {VOLUME_BACKUP_INTERVAL_HOURS:?}, got {}",
+                self.interval_hours
+            ));
+        }
+        if self.retention_days == 0 {
+            return Some("backup retentionDays must be at least 1".to_string());
+        }
+        if self.retention_days > VOLUME_BACKUP_MAX_RETENTION_DAYS {
+            return Some(format!(
+                "backup retentionDays must be at most {VOLUME_BACKUP_MAX_RETENTION_DAYS}, got {}",
+                self.retention_days
+            ));
+        }
+        let snapshots = self.retention_days * 24 / self.interval_hours;
+        if snapshots > VOLUME_BACKUP_MAX_SNAPSHOTS {
+            return Some(format!(
+                "backups every {} hours for {} days keep {snapshots} snapshots per volume; \
+                 the most is {VOLUME_BACKUP_MAX_SNAPSHOTS}",
+                self.interval_hours, self.retention_days
+            ));
+        }
+        None
+    }
 }
 
 /// Mounts an existing, setup-owned Kubernetes Secret into a Container pod.
@@ -537,6 +641,76 @@ pub struct ContainerOutputs {
     pub public_endpoints: HashMap<String, PublicEndpointOutput>,
     /// Status of each replica
     pub replicas: Vec<ReplicaStatus>,
+    /// Persistent volumes, one per replica ordinal, with their latest snapshot.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub volumes: Vec<VolumeOutput>,
+    /// Whether the persistent volumes' snapshot schedule is in place.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub volume_backups: Option<VolumeBackupsStatus>,
+}
+
+/// Whether a container's snapshot schedule is in place.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct VolumeBackupsStatus {
+    /// Current state of the schedule
+    pub state: VolumeBackupsState,
+    /// What is missing when the state is `setupRequired`
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+}
+
+/// State of a container's snapshot schedule.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub enum VolumeBackupsState {
+    /// The cloud's scheduler is taking snapshots.
+    Active,
+    /// Backups are turned off in the stack.
+    Disabled,
+    /// The deployment's management permissions predate volume backups. The
+    /// container keeps running without a schedule until the installation's
+    /// setup is updated; the controller then applies the schedule by itself.
+    SetupRequired,
+}
+
+/// A replica's persistent volume and its latest completed snapshot.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct VolumeOutput {
+    /// Replica ordinal the volume belongs to
+    pub ordinal: u32,
+    /// Cloud ID of the volume (EBS volume ID, Persistent Disk name, or Managed Disk ID)
+    pub volume_id: String,
+    /// Zone the volume lives in
+    pub zone: String,
+    /// Cloud ID of the latest completed snapshot, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_snapshot_id: Option<String>,
+    /// When the latest completed snapshot was started (RFC 3339)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_snapshot_at: Option<String>,
+    /// The latest volume restore performed on this ordinal, if any
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_restore: Option<VolumeRestoreOutput>,
+}
+
+/// A completed volume restore.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
+#[serde(rename_all = "camelCase")]
+pub struct VolumeRestoreOutput {
+    /// ID of the restore request
+    pub request_id: String,
+    /// Snapshot the volume was restored from
+    pub snapshot_id: String,
+    /// Snapshot of the replaced volume, taken just before it was deleted
+    pub replaced_volume_snapshot_id: String,
+    /// When the restored volume was put in place (RFC 3339)
+    pub completed_at: String,
 }
 
 impl ResourceOutputsDefinition for ContainerOutputs {
@@ -788,6 +962,7 @@ mod tests {
             .persistent_storage(PersistentStorage {
                 size: "100Gi".to_string(),
                 mount_path: "/var/lib/postgresql/data".to_string(),
+                backups: VolumeBackups::default(),
             })
             .permissions("database".to_string())
             .build();
diff --git a/crates/alien-deployment/src/runner.rs b/crates/alien-deployment/src/runner.rs
index 8e9d428529..bb3ba8cdec 100644
--- a/crates/alien-deployment/src/runner.rs
+++ b/crates/alien-deployment/src/runner.rs
@@ -919,6 +919,7 @@ mod tests {
             manager_url: None,
             deployment_token: None,
             native_image_host: None,
+            volume_restores: Vec::new(),
         }
     }
 
diff --git a/crates/alien-deployment/tests/test_platform.rs b/crates/alien-deployment/tests/test_platform.rs
index 4a7f30f51b..fe5e65f142 100644
--- a/crates/alien-deployment/tests/test_platform.rs
+++ b/crates/alien-deployment/tests/test_platform.rs
@@ -268,6 +268,7 @@ fn create_test_config(env_vars_hash: &str, include_secret: bool) -> DeploymentCo
         manager_url: None,
         deployment_token: None,
         native_image_host: None,
+        volume_restores: Vec::new(),
     }
 }
 
diff --git a/crates/alien-gcp-clients/src/gcp/compute.rs b/crates/alien-gcp-clients/src/gcp/compute.rs
index a7ccb5a193..a291814cd8 100644
--- a/crates/alien-gcp-clients/src/gcp/compute.rs
+++ b/crates/alien-gcp-clients/src/gcp/compute.rs
@@ -4,7 +4,7 @@
 //! - VPC networks, subnetworks, routers, and firewalls
 //! - Load balancing: health checks, backend services, URL maps, proxies, forwarding rules, NEGs
 //! - Instance management: instance templates, instance group managers, instances
-//! - Persistent disks
+//! - Persistent disks, snapshot schedules (resource policies), and snapshots
 //!
 //! See:
 //! - Networks: https://cloud.google.com/compute/docs/reference/rest/v1/networks
@@ -22,6 +22,8 @@
 //! - Instance Group Managers: https://cloud.google.com/compute/docs/reference/rest/v1/instanceGroupManagers
 //! - Instances: https://cloud.google.com/compute/docs/reference/rest/v1/instances
 //! - Disks: https://cloud.google.com/compute/docs/reference/rest/v1/disks
+//! - Resource Policies: https://cloud.google.com/compute/docs/reference/rest/v1/resourcePolicies
+//! - Snapshots: https://cloud.google.com/compute/docs/reference/rest/v1/snapshots
 
 use crate::gcp::api_client::{GcpClientBase, GcpServiceConfig};
 use crate::gcp::GcpClientConfig;
@@ -591,6 +593,79 @@ pub trait ComputeApi: Send + Sync + Debug {
     /// See: https://cloud.google.com/compute/docs/reference/rest/v1/disks/delete
     async fn delete_disk(&self, zone: String, disk_name: String) -> Result<Operation>;
 
+    /// Attaches a resource policy (such as a snapshot schedule) to a disk.
+    /// Compute Engine accepts one policy per call.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/disks/addResourcePolicies
+    async fn add_disk_resource_policies(
+        &self,
+        zone: String,
+        disk_name: String,
+        request: DisksAddResourcePoliciesRequest,
+    ) -> Result<Operation>;
+
+    /// Detaches resource policies from a disk.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/disks/removeResourcePolicies
+    async fn remove_disk_resource_policies(
+        &self,
+        zone: String,
+        disk_name: String,
+        request: DisksRemoveResourcePoliciesRequest,
+    ) -> Result<Operation>;
+
+    // --- Resource Policy Operations ---
+
+    /// Gets a regional resource policy.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/resourcePolicies/get
+    async fn get_resource_policy(&self, region: String, policy_name: String)
+        -> Result<ResourcePolicy>;
+
+    /// Creates a regional resource policy.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/resourcePolicies/insert
+    async fn insert_resource_policy(
+        &self,
+        region: String,
+        policy: ResourcePolicy,
+    ) -> Result<Operation>;
+
+    /// Lists one page of regional resource policies, optionally filtered.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/resourcePolicies/list
+    async fn list_resource_policies(
+        &self,
+        region: String,
+        filter: Option<String>,
+        page_token: Option<String>,
+    ) -> Result<ResourcePolicyList>;
+
+    /// Deletes a regional resource policy. Fails while the policy is attached to a disk.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/resourcePolicies/delete
+    async fn delete_resource_policy(
+        &self,
+        region: String,
+        policy_name: String,
+    ) -> Result<Operation>;
+
+    // --- Snapshot Operations ---
+
+    /// Gets a (global) snapshot.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/snapshots/get
+    async fn get_snapshot(&self, snapshot_name: String) -> Result<Snapshot>;
+
+    /// Creates a (global) snapshot of `snapshot.source_disk`.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/snapshots/insert
+    async fn insert_snapshot(&self, snapshot: Snapshot) -> Result<Operation>;
+
+    /// Lists one page of snapshots, optionally filtered.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/snapshots/list
+    async fn list_snapshots(
+        &self,
+        filter: Option<String>,
+        page_token: Option<String>,
+    ) -> Result<SnapshotList>;
+
+    /// Deletes a snapshot.
+    /// See: https://cloud.google.com/compute/docs/reference/rest/v1/snapshots/delete
+    async fn delete_snapshot(&self, snapshot_name: String) -> Result<Operation>;
+
     // --- Serial Port Operations ---
 
     /// Gets the serial port output of an instance (port 1 = main console).
@@ -1945,6 +2020,161 @@ impl ComputeApi for ComputeClient {
             .await
     }
 
+    async fn add_disk_resource_policies(
+        &self,
+        zone: String,
+        disk_name: String,
+        request: DisksAddResourcePoliciesRequest,
+    ) -> Result<Operation> {
+        let path = format!(
+            "projects/{}/zones/{}/disks/{}/addResourcePolicies",
+            self.project_id, zone, disk_name
+        );
+        self.base
+            .execute_request(Method::POST, &path, None, Some(request), &disk_name)
+            .await
+    }
+
+    async fn remove_disk_resource_policies(
+        &self,
+        zone: String,
+        disk_name: String,
+        request: DisksRemoveResourcePoliciesRequest,
+    ) -> Result<Operation> {
+        let path = format!(
+            "projects/{}/zones/{}/disks/{}/removeResourcePolicies",
+            self.project_id, zone, disk_name
+        );
+        self.base
+            .execute_request(Method::POST, &path, None, Some(request), &disk_name)
+            .await
+    }
+
+    // --- Resource Policy Operations ---
+
+    async fn get_resource_policy(
+        &self,
+        region: String,
+        policy_name: String,
+    ) -> Result<ResourcePolicy> {
+        let path = format!(
+            "projects/{}/regions/{}/resourcePolicies/{}",
+            self.project_id, region, policy_name
+        );
+        self.base
+            .execute_request(Method::GET, &path, None, Option::<()>::None, &policy_name)
+            .await
+    }
+
+    async fn insert_resource_policy(
+        &self,
+        region: String,
+        policy: ResourcePolicy,
+    ) -> Result<Operation> {
+        let path = format!(
+            "projects/{}/regions/{}/resourcePolicies",
+            self.project_id, region
+        );
+        let resource_name = policy.name.clone().unwrap_or_default();
+        self.base
+            .execute_request(Method::POST, &path, None, Some(policy), &resource_name)
+            .await
+    }
+
+    async fn list_resource_policies(
+        &self,
+        region: String,
+        filter: Option<String>,
+        page_token: Option<String>,
+    ) -> Result<ResourcePolicyList> {
+        let path = format!(
+            "projects/{}/regions/{}/resourcePolicies",
+            self.project_id, region
+        );
+        self.base
+            .execute_request(
+                Method::GET,
+                &path,
+                list_query(filter, page_token),
+                Option::<()>::None,
+                "resourcePolicies",
+            )
+            .await
+    }
+
+    async fn delete_resource_policy(
+        &self,
+        region: String,
+        policy_name: String,
+    ) -> Result<Operation> {
+        let path = format!(
+            "projects/{}/regions/{}/resourcePolicies/{}",
+            self.project_id, region, policy_name
+        );
+        self.base
+            .execute_request(
+                Method::DELETE,
+                &path,
+                None,
+                Option::<()>::None,
+                &policy_name,
+            )
+            .await
+    }
+
+    // --- Snapshot Operations ---
+
+    async fn get_snapshot(&self, snapshot_name: String) -> Result<Snapshot> {
+        let path = format!(
+            "projects/{}/global/snapshots/{}",
+            self.project_id, snapshot_name
+        );
+        self.base
+            .execute_request(Method::GET, &path, None, Option::<()>::None, &snapshot_name)
+            .await
+    }
+
+    async fn insert_snapshot(&self, snapshot: Snapshot) -> Result<Operation> {
+        let path = format!("projects/{}/global/snapshots", self.project_id);
+        let resource_name = snapshot.name.clone().unwrap_or_default();
+        self.base
+            .execute_request(Method::POST, &path, None, Some(snapshot), &resource_name)
+            .await
+    }
+
+    async fn list_snapshots(
+        &self,
+        filter: Option<String>,
+        page_token: Option<String>,
+    ) -> Result<SnapshotList> {
+        let path = format!("projects/{}/global/snapshots", self.project_id);
+        self.base
+            .execute_request(
+                Method::GET,
+                &path,
+                list_query(filter, page_token),
+                Option::<()>::None,
+                "snapshots",
+            )
+            .await
+    }
+
+    async fn delete_snapshot(&self, snapshot_name: String) -> Result<Operation> {
+        let path = format!(
+            "projects/{}/global/snapshots/{}",
+            self.project_id, snapshot_name
+        );
+        self.base
+            .execute_request(
+                Method::DELETE,
+                &path,
+                None,
+                Option::<()>::None,
+                &snapshot_name,
+            )
+            .await
+    }
+
     async fn get_serial_port_output(
         &self,
         zone: String,
@@ -1966,6 +2196,19 @@ impl ComputeApi for ComputeClient {
     }
 }
 
+/// Query parameters for a paginated, optionally filtered `list` call.
+fn list_query(
+    filter: Option<String>,
+    page_token: Option<String>,
+) -> Option<Vec<(&'static str, String)>> {
+    let params: Vec<(&'static str, String)> = filter
+        .map(|filter| ("filter", filter))
+        .into_iter()
+        .chain(page_token.map(|token| ("pageToken", token)))
+        .collect();
+    (!params.is_empty()).then_some(params)
+}
+
 // =============================================================================================
 // Data Structures - Operation
 // =============================================================================================
@@ -5629,6 +5872,11 @@ pub struct Disk {
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub users: Vec<String>,
 
+    /// Resource policies (such as snapshot schedules) attached to this disk, as URLs.
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub resource_policies: Vec<String>,
+
     /// Labels for this disk.
     #[builder(default)]
     #[serde(default, skip_serializing_if = "std::collections::HashMap::is_empty")]
@@ -5683,6 +5931,314 @@ pub enum DiskStatus {
     Deleting,
 }
 
+/// Request body for `disks.addResourcePolicies`.
+/// See: https://cloud.google.com/compute/docs/reference/rest/v1/disks/addResourcePolicies
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct DisksAddResourcePoliciesRequest {
+    /// Full or relative URL of the resource policy to attach. Compute Engine accepts one.
+    #[builder(default)]
+    #[serde(default)]
+    pub resource_policies: Vec<String>,
+}
+
+/// Request body for `disks.removeResourcePolicies`.
+/// See: https://cloud.google.com/compute/docs/reference/rest/v1/disks/removeResourcePolicies
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct DisksRemoveResourcePoliciesRequest {
+    /// Full or relative URLs of the resource policies to detach.
+    #[builder(default)]
+    #[serde(default)]
+    pub resource_policies: Vec<String>,
+}
+
+// =============================================================================================
+// Data Structures - Resource Policy
+// =============================================================================================
+
+/// A regional resource policy. Only snapshot schedules are modelled.
+/// See: https://cloud.google.com/compute/docs/reference/rest/v1/resourcePolicies
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourcePolicy {
+    /// Unique identifier; defined by the server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+
+    /// Name of the resource (1-63 characters, RFC 1035).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+
+    /// Optional description.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+
+    /// Region URL.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub region: Option<String>,
+
+    /// Server-defined URL for the resource.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub self_link: Option<String>,
+
+    /// Status of the policy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<ResourcePolicyStatus>,
+
+    /// Snapshot schedule for the disks this policy is attached to.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snapshot_schedule_policy: Option<ResourcePolicySnapshotSchedulePolicy>,
+
+    /// Creation timestamp (RFC3339).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub creation_timestamp: Option<String>,
+
+    /// Type of resource (always "compute#resourcePolicy").
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kind: Option<String>,
+}
+
+/// Resource policy status.
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum ResourcePolicyStatus {
+    /// Policy is being created.
+    Creating,
+    /// Policy is being deleted.
+    Deleting,
+    /// Policy has expired.
+    Expired,
+    /// Policy is invalid.
+    Invalid,
+    /// Policy is ready to be attached.
+    Ready,
+}
+
+/// Snapshot schedule of a resource policy.
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourcePolicySnapshotSchedulePolicy {
+    /// When snapshots are taken.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub schedule: Option<ResourcePolicySnapshotSchedulePolicySchedule>,
+
+    /// How long snapshots are kept.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub retention_policy: Option<ResourcePolicySnapshotSchedulePolicyRetentionPolicy>,
+
+    /// Properties (such as labels) given to every scheduled snapshot.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snapshot_properties: Option<ResourcePolicySnapshotSchedulePolicySnapshotProperties>,
+}
+
+/// Snapshot schedule frequency. Exactly one of the cycles is set.
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourcePolicySnapshotSchedulePolicySchedule {
+    /// Every N hours.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub hourly_schedule: Option<ResourcePolicyHourlyCycle>,
+
+    /// Every N days.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub daily_schedule: Option<ResourcePolicyDailyCycle>,
+}
+
+/// Hourly snapshot cycle.
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourcePolicyHourlyCycle {
+    /// Hours between snapshots. Google documents values that divide 24: 1, 2, 3, 4, 6, 8, 12.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub hours_in_cycle: Option<i32>,
+
+    /// Window start, "HH:00" in UTC.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub start_time: Option<String>,
+
+    /// Window length chosen by the server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub duration: Option<String>,
+}
+
+/// Daily snapshot cycle.
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourcePolicyDailyCycle {
+    /// Days between snapshots.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub days_in_cycle: Option<i32>,
+
+    /// Window start in UTC; must resolve to 00:00, 04:00, 08:00, 12:00, 16:00 or 20:00.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub start_time: Option<String>,
+
+    /// Window length chosen by the server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub duration: Option<String>,
+}
+
+/// Retention of scheduled snapshots.
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourcePolicySnapshotSchedulePolicyRetentionPolicy {
+    /// Maximum age of a scheduled snapshot, in days.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_retention_days: Option<i32>,
+
+    /// What happens to scheduled snapshots when their source disk is deleted.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub on_source_disk_delete: Option<OnSourceDiskDelete>,
+}
+
+/// Behaviour for scheduled snapshots whose source disk is deleted.
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum OnSourceDiskDelete {
+    /// Keep expiring snapshots per the retention policy.
+    ApplyRetentionPolicy,
+    /// Keep scheduled snapshots forever.
+    KeepAutoSnapshots,
+    /// Unspecified.
+    UnspecifiedOnSourceDiskDelete,
+}
+
+/// Properties of scheduled snapshots.
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourcePolicySnapshotSchedulePolicySnapshotProperties {
+    /// Labels applied to every scheduled snapshot.
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "std::collections::HashMap::is_empty")]
+    pub labels: std::collections::HashMap<String, String>,
+
+    /// Cloud Storage location of the snapshots (regional or multi-regional).
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub storage_locations: Vec<String>,
+}
+
+/// One page of resource policies.
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct ResourcePolicyList {
+    /// Resource policies on this page.
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub items: Vec<ResourcePolicy>,
+
+    /// Token for the next page of results.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_page_token: Option<String>,
+}
+
+// =============================================================================================
+// Data Structures - Snapshot
+// =============================================================================================
+
+/// A (global) persistent disk snapshot.
+/// See: https://cloud.google.com/compute/docs/reference/rest/v1/snapshots
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct Snapshot {
+    /// Unique identifier; defined by the server.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub id: Option<String>,
+
+    /// Name of the resource (1-63 characters, RFC 1035).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+
+    /// Optional description.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub description: Option<String>,
+
+    /// Disk the snapshot is taken from (URL). Required on insert.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_disk: Option<String>,
+
+    /// ID of the source disk.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_disk_id: Option<String>,
+
+    /// Status of the snapshot.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub status: Option<SnapshotStatus>,
+
+    /// Size of the source disk in GB.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub disk_size_gb: Option<String>,
+
+    /// Bytes of storage used by the snapshot.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub storage_bytes: Option<String>,
+
+    /// Labels for this snapshot.
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "std::collections::HashMap::is_empty")]
+    pub labels: std::collections::HashMap<String, String>,
+
+    /// Label fingerprint for optimistic locking.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub label_fingerprint: Option<String>,
+
+    /// True if a snapshot schedule created the snapshot.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub auto_created: Option<bool>,
+
+    /// URL of the snapshot schedule that created the snapshot.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub source_snapshot_schedule_policy: Option<String>,
+
+    /// Cloud Storage location of the snapshot.
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub storage_locations: Vec<String>,
+
+    /// Server-defined URL for the resource.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub self_link: Option<String>,
+
+    /// Creation timestamp (RFC3339).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub creation_timestamp: Option<String>,
+
+    /// Type of resource (always "compute#snapshot").
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub kind: Option<String>,
+}
+
+/// Snapshot status.
+#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum SnapshotStatus {
+    /// Snapshot is being created.
+    Creating,
+    /// Snapshot is being deleted.
+    Deleting,
+    /// Snapshot creation failed.
+    Failed,
+    /// Snapshot is complete and usable.
+    Ready,
+    /// Snapshot is being uploaded.
+    Uploading,
+}
+
+/// One page of snapshots.
+#[derive(Debug, Serialize, Deserialize, Clone, Default, Builder)]
+#[serde(rename_all = "camelCase")]
+pub struct SnapshotList {
+    /// Snapshots on this page.
+    #[builder(default)]
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub items: Vec<Snapshot>,
+
+    /// Token for the next page of results.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub next_page_token: Option<String>,
+}
+
 // =============================================================================================
 // Data Structures - Serial Port Output
 // =============================================================================================
@@ -5920,4 +6476,314 @@ mod tests {
             })
         );
     }
+    /// Serves `responses.len()` HTTP requests, answering each with the next JSON body,
+    /// and returns the raw requests (headers + body) it received.
+    fn serve_json_responses(
+        responses: Vec<&'static str>,
+    ) -> (String, std::thread::JoinHandle<Vec<String>>) {
+        use std::{
+            io::{Read, Write},
+            net::TcpListener,
+        };
+
+        let listener = TcpListener::bind("127.0.0.1:0").expect("bind test server");
+        let endpoint = format!("http://{}", listener.local_addr().expect("local address"));
+        let server = std::thread::spawn(move || {
+            let mut requests = Vec::new();
+            for body in responses {
+                let (mut stream, _) = listener.accept().expect("accept request");
+                let mut bytes = Vec::new();
+                let mut buffer = [0_u8; 4096];
+                let (header_end, content_length) = loop {
+                    let count = stream.read(&mut buffer).expect("read request");
+                    assert!(count > 0, "request ended before headers");
+                    bytes.extend_from_slice(&buffer[..count]);
+                    if let Some(end) = bytes.windows(4).position(|window| window == b"\r\n\r\n") {
+                        let header_end = end + 4;
+                        let headers = String::from_utf8_lossy(&bytes[..header_end]);
+                        let length: usize = headers
+                            .lines()
+                            .find_map(|line| {
+                                line.to_ascii_lowercase()
+                                    .strip_prefix("content-length: ")
+                                    .and_then(|value| value.parse().ok())
+                            })
+                            .unwrap_or(0);
+                        break (header_end, length);
+                    }
+                };
+                while bytes.len() < header_end + content_length {
+                    let count = stream.read(&mut buffer).expect("read body");
+                    assert!(count > 0, "request ended before body");
+                    bytes.extend_from_slice(&buffer[..count]);
+                }
+                requests.push(
+                    String::from_utf8(bytes[..header_end + content_length].to_vec())
+                        .expect("request utf8"),
+                );
+                write!(stream, "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{}", body.len(), body).expect("write response");
+            }
+            requests
+        });
+        (endpoint, server)
+    }
+
+    fn test_client(endpoint: String) -> ComputeClient {
+        use alien_core::{GcpCredentials, GcpServiceOverrides};
+        ComputeClient::new(
+            Client::new(),
+            GcpClientConfig {
+                project_id: "example-project".to_string(),
+                region: "us-central1".to_string(),
+                credentials: GcpCredentials::AccessToken {
+                    token: "test-token".to_string(),
+                },
+                service_overrides: Some(GcpServiceOverrides {
+                    endpoints: std::collections::HashMap::from([(
+                        "compute".to_string(),
+                        endpoint,
+                    )]),
+                }),
+                project_number: None,
+            },
+        )
+    }
+
+    fn request_line_and_body(request: &str) -> (&str, serde_json::Value) {
+        let (headers, body) = request.split_once("\r\n\r\n").expect("request");
+        let line = headers.lines().next().expect("request line");
+        let body = if body.is_empty() {
+            serde_json::Value::Null
+        } else {
+            serde_json::from_str(body).expect("request JSON")
+        };
+        (line, body)
+    }
+
+    #[tokio::test]
+    async fn snapshot_schedule_and_snapshot_calls_use_compute_rest_contract() {
+        const OPERATION: &str = r#"{"name":"operation-1","status":"DONE"}"#;
+        let (endpoint, server) = serve_json_responses(vec![
+            OPERATION,
+            r#"{"name":"stack-c-bk-1h2d","status":"READY","selfLink":"https://www.googleapis.com/compute/v1/projects/example-project/regions/us-central1/resourcePolicies/stack-c-bk-1h2d"}"#,
+            r#"{"items":[{"name":"stack-c-bk-1h2d"}],"nextPageToken":"next"}"#,
+            OPERATION,
+            OPERATION,
+            OPERATION,
+            OPERATION,
+            r#"{"name":"snap-1","status":"READY","sourceDisk":"https://www.googleapis.com/compute/v1/projects/example-project/zones/us-central1-a/disks/disk-0","diskSizeGb":"10","labels":{"resource":"c"},"creationTimestamp":"2026-10-05T10:00:00.000-07:00","autoCreated":true}"#,
+            r#"{"items":[{"name":"snap-1","status":"READY"}]}"#,
+            OPERATION,
+        ]);
+        let client = test_client(endpoint);
+
+        let policy = ResourcePolicy::builder()
+            .name("stack-c-bk-1h2d".to_string())
+            .snapshot_schedule_policy(
+                ResourcePolicySnapshotSchedulePolicy::builder()
+                    .schedule(
+                        ResourcePolicySnapshotSchedulePolicySchedule::builder()
+                            .hourly_schedule(
+                                ResourcePolicyHourlyCycle::builder()
+                                    .hours_in_cycle(1)
+                                    .start_time("00:00".to_string())
+                                    .build(),
+                            )
+                            .build(),
+                    )
+                    .retention_policy(
+                        ResourcePolicySnapshotSchedulePolicyRetentionPolicy::builder()
+                            .max_retention_days(2)
+                            .on_source_disk_delete(OnSourceDiskDelete::ApplyRetentionPolicy)
+                            .build(),
+                    )
+                    .snapshot_properties(
+                        ResourcePolicySnapshotSchedulePolicySnapshotProperties::builder()
+                            .labels(std::collections::HashMap::from([(
+                                "resource".to_string(),
+                                "c".to_string(),
+                            )]))
+                            .build(),
+                    )
+                    .build(),
+            )
+            .build();
+        client
+            .insert_resource_policy("us-central1".to_string(), policy)
+            .await
+            .expect("insert policy");
+        let fetched = client
+            .get_resource_policy("us-central1".to_string(), "stack-c-bk-1h2d".to_string())
+            .await
+            .expect("get policy");
+        assert_eq!(fetched.status, Some(ResourcePolicyStatus::Ready));
+        let page = client
+            .list_resource_policies(
+                "us-central1".to_string(),
+                Some("name eq stack-c-bk-.*".to_string()),
+                Some("token-1".to_string()),
+            )
+            .await
+            .expect("list policies");
+        assert_eq!(page.items.len(), 1);
+        assert_eq!(page.next_page_token.as_deref(), Some("next"));
+        client
+            .add_disk_resource_policies(
+                "us-central1-a".to_string(),
+                "disk-0".to_string(),
+                DisksAddResourcePoliciesRequest {
+                    resource_policies: vec![
+                        "projects/example-project/regions/us-central1/resourcePolicies/stack-c-bk-1h2d"
+                            .to_string(),
+                    ],
+                },
+            )
+            .await
+            .expect("attach policy");
+        client
+            .remove_disk_resource_policies(
+                "us-central1-a".to_string(),
+                "disk-0".to_string(),
+                DisksRemoveResourcePoliciesRequest {
+                    resource_policies: vec![
+                        "projects/example-project/regions/us-central1/resourcePolicies/stack-c-bk-1h2d"
+                            .to_string(),
+                    ],
+                },
+            )
+            .await
+            .expect("detach policy");
+        client
+            .delete_resource_policy("us-central1".to_string(), "stack-c-bk-1h2d".to_string())
+            .await
+            .expect("delete policy");
+        client
+            .insert_snapshot(
+                Snapshot::builder()
+                    .name("snap-final-0".to_string())
+                    .source_disk(
+                        "projects/example-project/zones/us-central1-a/disks/disk-0".to_string(),
+                    )
+                    .labels(std::collections::HashMap::from([(
+                        "ordinal".to_string(),
+                        "0".to_string(),
+                    )]))
+                    .build(),
+            )
+            .await
+            .expect("insert snapshot");
+        let snapshot = client
+            .get_snapshot("snap-1".to_string())
+            .await
+            .expect("get snapshot");
+        assert_eq!(snapshot.status, Some(SnapshotStatus::Ready));
+        assert_eq!(snapshot.disk_size_gb.as_deref(), Some("10"));
+        assert_eq!(snapshot.auto_created, Some(true));
+        let snapshots = client
+            .list_snapshots(Some("(labels.resource = \"c\")".to_string()), None)
+            .await
+            .expect("list snapshots");
+        assert_eq!(snapshots.items.len(), 1);
+        assert!(snapshots.next_page_token.is_none());
+        client
+            .delete_snapshot("snap-1".to_string())
+            .await
+            .expect("delete snapshot");
+
+        let requests = server.join().expect("server should finish");
+        let calls: Vec<_> = requests
+            .iter()
+            .map(|request| request_line_and_body(request))
+            .collect();
+
+        assert_eq!(
+            calls[0].0,
+            "POST /projects/example-project/regions/us-central1/resourcePolicies HTTP/1.1"
+        );
+        assert_eq!(
+            calls[0].1,
+            serde_json::json!({
+                "name": "stack-c-bk-1h2d",
+                "snapshotSchedulePolicy": {
+                    "schedule": {"hourlySchedule": {"hoursInCycle": 1, "startTime": "00:00"}},
+                    "retentionPolicy": {
+                        "maxRetentionDays": 2,
+                        "onSourceDiskDelete": "APPLY_RETENTION_POLICY"
+                    },
+                    "snapshotProperties": {"labels": {"resource": "c"}}
+                }
+            })
+        );
+        assert_eq!(
+            calls[1].0,
+            "GET /projects/example-project/regions/us-central1/resourcePolicies/stack-c-bk-1h2d HTTP/1.1"
+        );
+        assert_eq!(
+            calls[2].0,
+            "GET /projects/example-project/regions/us-central1/resourcePolicies?filter=name+eq+stack-c-bk-.*&pageToken=token-1 HTTP/1.1"
+        );
+        assert_eq!(
+            calls[3].0,
+            "POST /projects/example-project/zones/us-central1-a/disks/disk-0/addResourcePolicies HTTP/1.1"
+        );
+        assert_eq!(
+            calls[3].1,
+            serde_json::json!({"resourcePolicies": ["projects/example-project/regions/us-central1/resourcePolicies/stack-c-bk-1h2d"]})
+        );
+        assert_eq!(
+            calls[4].0,
+            "POST /projects/example-project/zones/us-central1-a/disks/disk-0/removeResourcePolicies HTTP/1.1"
+        );
+        assert_eq!(calls[4].1, calls[3].1);
+        assert_eq!(
+            calls[5].0,
+            "DELETE /projects/example-project/regions/us-central1/resourcePolicies/stack-c-bk-1h2d HTTP/1.1"
+        );
+        assert_eq!(
+            calls[6].0,
+            "POST /projects/example-project/global/snapshots HTTP/1.1"
+        );
+        assert_eq!(
+            calls[6].1,
+            serde_json::json!({
+                "name": "snap-final-0",
+                "sourceDisk": "projects/example-project/zones/us-central1-a/disks/disk-0",
+                "labels": {"ordinal": "0"}
+            })
+        );
+        assert_eq!(
+            calls[7].0,
+            "GET /projects/example-project/global/snapshots/snap-1 HTTP/1.1"
+        );
+        assert_eq!(
+            calls[8].0,
+            "GET /projects/example-project/global/snapshots?filter=%28labels.resource+%3D+%22c%22%29 HTTP/1.1"
+        );
+        assert_eq!(
+            calls[9].0,
+            "DELETE /projects/example-project/global/snapshots/snap-1 HTTP/1.1"
+        );
+    }
+
+    #[test]
+    fn disk_from_snapshot_serializes_source_snapshot_and_policies() {
+        let disk = Disk::builder()
+            .name("stack-c-disk-0-r1".to_string())
+            .size_gb("20".to_string())
+            .source_snapshot("projects/example-project/global/snapshots/snap-1".to_string())
+            .resource_policies(vec![
+                "projects/example-project/regions/us-central1/resourcePolicies/stack-c-bk-1h2d"
+                    .to_string(),
+            ])
+            .build();
+        assert_eq!(
+            serde_json::to_value(disk).expect("disk should serialize"),
+            serde_json::json!({
+                "name": "stack-c-disk-0-r1",
+                "sizeGb": "20",
+                "sourceSnapshot": "projects/example-project/global/snapshots/snap-1",
+                "resourcePolicies": ["projects/example-project/regions/us-central1/resourcePolicies/stack-c-bk-1h2d"]
+            })
+        );
+    }
 }
diff --git a/crates/alien-infra/src/container/kubernetes.rs b/crates/alien-infra/src/container/kubernetes.rs
index 74269be743..66d2f843c1 100644
--- a/crates/alien-infra/src/container/kubernetes.rs
+++ b/crates/alien-infra/src/container/kubernetes.rs
@@ -1693,6 +1693,10 @@ impl KubernetesContainerController {
                     None => format!("{workload_name}.svc.cluster.local"),
                 },
                 replicas: Vec::new(), // Replica details tracked separately
+                // Kubernetes leaves volume snapshots to the cluster's own tooling. With no
+                // volumes reported, there is nothing to restore.
+                volumes: Vec::new(),
+                volume_backups: None,
                 public_endpoints: self
                     .public_endpoint
                     .effective_public_url()
diff --git a/crates/alien-infra/src/container/local.rs b/crates/alien-infra/src/container/local.rs
index bea266756d..a171c47e34 100644
--- a/crates/alien-infra/src/container/local.rs
+++ b/crates/alien-infra/src/container/local.rs
@@ -677,6 +677,10 @@ impl LocalContainerController {
                 internal_dns: info.internal_dns.clone(),
                 public_endpoints: local_public_endpoint_outputs(info),
                 replicas: Vec::new(), // TODO: Add replica status
+                // A local volume is a host directory: nothing is snapshotted, and with no
+                // volumes reported there is nothing to restore.
+                volumes: Vec::new(),
+                volume_backups: None,
             })
         })
     }
diff --git a/crates/alien-infra/src/core/controller_test.rs b/crates/alien-infra/src/core/controller_test.rs
index 4227d9e4ae..d0fcb4dca1 100644
--- a/crates/alien-infra/src/core/controller_test.rs
+++ b/crates/alien-infra/src/core/controller_test.rs
@@ -347,6 +347,8 @@ pub struct SingleControllerExecutor {
     monitoring: Option<alien_core::OtlpConfig>,
     // Domain metadata for public resources (certificates, DNS)
     domain_metadata: Option<DomainMetadata>,
+    // Volume restore requests carried in the deployment config
+    volume_restores: Vec<alien_core::VolumeRestoreRequest>,
     // Public endpoint URL overrides for testing.
     public_endpoints: Option<alien_core::PublicEndpointUrls>,
     // Stack and state
@@ -415,6 +417,7 @@ impl SingleControllerExecutor {
                 .allow_frozen_changes(false)
                 .maybe_domain_metadata(self.domain_metadata.clone())
                 .maybe_public_endpoints(self.public_endpoints.clone())
+                .volume_restores(self.volume_restores.clone())
                 .manager_url("https://test-manager.alien.dev".to_string())
                 .deployment_token("test-deployment-token".to_string())
                 .build(),
@@ -649,6 +652,55 @@ impl SingleControllerExecutor {
     }
 
     /// Gets the current status of the controller.
+    /// Runs `f` with the controller context the next step would see, for
+    /// checks that are not steps (for example `needs_update`).
+    pub fn with_context<T>(&self, f: impl FnOnce(&ResourceControllerContext<'_>) -> T) -> T {
+        let desired_config = self
+            .desired_stack
+            .resources
+            .get(&self.resource_id)
+            .map(|entry| entry.config.clone())
+            .expect("the resource is in the desired stack");
+        let deployment_config = DeploymentConfig::builder()
+            .stack_settings(self.stack_settings.clone())
+            .maybe_management_config(self.management_config.clone())
+            .maybe_compute_backend(self.compute_backend.clone())
+            .environment_variables(self.environment_variables.clone())
+            .maybe_monitoring(self.monitoring.clone())
+            .external_bindings(self.external_bindings.clone())
+            .allow_frozen_changes(false)
+            .maybe_domain_metadata(self.domain_metadata.clone())
+            .maybe_public_endpoints(self.public_endpoints.clone())
+            .volume_restores(self.volume_restores.clone())
+            .manager_url("https://test-manager.alien.dev".to_string())
+            .deployment_token("test-deployment-token".to_string())
+            .build();
+        let context = ResourceControllerContext {
+            desired_config: &desired_config,
+            platform: self.platform,
+            client_config: self.client_config.clone(),
+            state: &self.stack_state,
+            resource_prefix: &self.resource_prefix,
+            registry: &self.registry,
+            desired_stack: &self.desired_stack,
+            service_provider: &self.service_provider,
+            deployment_config: &deployment_config,
+            initial_setup_authority: self.initial_setup_authority,
+            heartbeat_collector: HeartbeatCollector::default(),
+        };
+        f(&context)
+    }
+
+    /// Whether the controller asks for an update with an unchanged config.
+    pub fn needs_update(&self) -> Result<bool> {
+        self.with_context(|ctx| self.controller.needs_update(ctx))
+    }
+
+    /// Replaces the volume restore requests the next steps see in the deployment config.
+    pub fn set_volume_restores(&mut self, requests: Vec<alien_core::VolumeRestoreRequest>) {
+        self.volume_restores = requests;
+    }
+
     pub fn status(&self) -> ResourceStatus {
         self.controller.get_status()
     }
@@ -688,6 +740,8 @@ pub struct SingleControllerExecutorBuilder {
     external_bindings: ExternalBindings,
     monitoring: Option<alien_core::OtlpConfig>,
     domain_metadata: Option<DomainMetadata>,
+    // Volume restore requests carried in the deployment config
+    volume_restores: Vec<alien_core::VolumeRestoreRequest>,
     public_endpoints: Option<alien_core::PublicEndpointUrls>,
     dependencies: Vec<(ResourceRef, Resource, Box<dyn ResourceController>)>,
     stack_resources: Vec<(Resource, ResourceLifecycle)>,
@@ -717,6 +771,7 @@ impl SingleControllerExecutorBuilder {
             external_bindings: ExternalBindings::default(),
             monitoring: None,
             domain_metadata: None,
+            volume_restores: Vec::new(),
             public_endpoints: None,
             dependencies: Vec::new(),
             stack_resources: Vec::new(),
@@ -809,6 +864,12 @@ impl SingleControllerExecutorBuilder {
         self
     }
 
+    /// Sets the volume restore requests in the deployment config.
+    pub fn volume_restores(mut self, requests: Vec<alien_core::VolumeRestoreRequest>) -> Self {
+        self.volume_restores = requests;
+        self
+    }
+
     /// Sets public endpoint URL overrides for testing.
     /// Overrides the FQDN-derived URL from domain_metadata, useful for pointing
     /// readiness probes at mock HTTP servers during tests.
@@ -1304,6 +1365,7 @@ impl SingleControllerExecutorBuilder {
             external_bindings: self.external_bindings,
             monitoring: self.monitoring,
             domain_metadata: self.domain_metadata,
+            volume_restores: self.volume_restores,
             public_endpoints: self.public_endpoints,
             desired_stack: stack,
             stack_state,
diff --git a/crates/alien-infra/src/core/service_provider.rs b/crates/alien-infra/src/core/service_provider.rs
index cbd12bd51d..0c68564bbe 100644
--- a/crates/alien-infra/src/core/service_provider.rs
+++ b/crates/alien-infra/src/core/service_provider.rs
@@ -8,6 +8,7 @@ use alien_aws_clients::{
     cloudcontrol::{CloudControlApi, CloudControlClient},
     cloudformation::{CloudFormationApi, CloudFormationClient},
     codebuild::{CodeBuildApi, CodeBuildClient},
+    dlm::{DlmApi, DlmClient},
     dynamodb::{DynamoDbApi, DynamoDbClient},
     ec2::{Ec2Api, Ec2Client},
     ecr::{EcrApi, EcrClient},
@@ -35,6 +36,7 @@ use alien_azure_clients::{
     compute::{AzureVmssClient, VirtualMachineScaleSetsApi},
     container_apps::{AzureContainerAppsClient, ContainerAppsApi},
     containerregistry::{AzureContainerRegistryClient, ContainerRegistryApi},
+    data_protection::{AzureDataProtectionClient, DataProtectionApi},
     disks::{AzureManagedDisksClient, ManagedDisksApi},
     event_grid::{AzureEventGridClient, EventGridApi},
     flexible_server::{AzureFlexibleServerClient, FlexibleServerApi},
@@ -57,6 +59,7 @@ use alien_azure_clients::{
         AzureServiceBusDataPlaneClient, AzureServiceBusManagementClient, ServiceBusDataPlaneApi,
         ServiceBusManagementApi,
     },
+    snapshots::{AzureSnapshotsClient, SnapshotsApi},
     storage_accounts::{AzureStorageAccountsClient, StorageAccountsApi},
     tables::{AzureTableManagementClient, TableManagementApi},
     AzureClientConfig, AzureTokenCache,
@@ -162,6 +165,7 @@ pub trait PlatformServiceProvider: Send + Sync {
         config: &AwsClientConfig,
     ) -> Result<Arc<dyn EventBridgeApi>>;
     async fn get_aws_kms_client(&self, config: &AwsClientConfig) -> Result<Arc<dyn KmsApi>>;
+    async fn get_aws_dlm_client(&self, config: &AwsClientConfig) -> Result<Arc<dyn DlmApi>>;
 
     // GCP clients
     fn get_gcp_iam_client(&self, config: &GcpClientConfig) -> Result<Arc<dyn GcpIamApi>>;
@@ -262,6 +266,14 @@ pub trait PlatformServiceProvider: Send + Sync {
         &self,
         config: &AzureClientConfig,
     ) -> Result<Arc<dyn FlexibleServerApi>>;
+    fn get_azure_snapshots_client(
+        &self,
+        config: &AzureClientConfig,
+    ) -> Result<Arc<dyn SnapshotsApi>>;
+    fn get_azure_data_protection_client(
+        &self,
+        config: &AzureClientConfig,
+    ) -> Result<Arc<dyn DataProtectionApi>>;
     fn get_azure_managed_identity_client(
         &self,
         config: &AzureClientConfig,
@@ -595,6 +607,19 @@ impl PlatformServiceProvider for DefaultPlatformServiceProvider {
         )))
     }
 
+    async fn get_aws_dlm_client(&self, config: &AwsClientConfig) -> Result<Arc<dyn DlmApi>> {
+        let credentials = AwsCredentialProvider::from_config(config.clone())
+            .await
+            .context(crate::error::ErrorData::CloudPlatformError {
+                message: "Failed to create AWS credential provider".to_string(),
+                resource_id: None,
+            })?;
+        Ok(Arc::new(DlmClient::new(
+            reqwest::Client::new(),
+            credentials,
+        )))
+    }
+
     async fn get_aws_ses_client(&self, config: &AwsClientConfig) -> Result<Arc<dyn SesApi>> {
         let credentials = AwsCredentialProvider::from_config(config.clone())
             .await
@@ -1138,6 +1163,26 @@ impl PlatformServiceProvider for DefaultPlatformServiceProvider {
         )))
     }
 
+    fn get_azure_snapshots_client(
+        &self,
+        config: &AzureClientConfig,
+    ) -> Result<Arc<dyn SnapshotsApi>> {
+        Ok(Arc::new(AzureSnapshotsClient::new(
+            reqwest::Client::new(),
+            AzureTokenCache::new(config.clone()),
+        )))
+    }
+
+    fn get_azure_data_protection_client(
+        &self,
+        config: &AzureClientConfig,
+    ) -> Result<Arc<dyn DataProtectionApi>> {
+        Ok(Arc::new(AzureDataProtectionClient::new(
+            reqwest::Client::new(),
+            AzureTokenCache::new(config.clone()),
+        )))
+    }
+
     fn get_azure_managed_identity_client(
         &self,
         config: &AzureClientConfig,
diff --git a/crates/alien-infra/src/remote_stack_management/aws.rs b/crates/alien-infra/src/remote_stack_management/aws.rs
index 3737965aa2..2be3b8b630 100644
--- a/crates/alien-infra/src/remote_stack_management/aws.rs
+++ b/crates/alien-infra/src/remote_stack_management/aws.rs
@@ -39,6 +39,10 @@ pub struct AwsRemoteStackManagementController {
     pub(crate) role_name: Option<String>,
     /// Whether management permissions have been applied
     pub(crate) management_permissions_applied: bool,
+    /// Revision of the management permissions last applied. Missing on
+    /// controllers from before revisions were recorded.
+    #[serde(default)]
+    pub(crate) management_permissions_revision: Option<String>,
 }
 
 #[controller]
@@ -168,6 +172,7 @@ impl AwsRemoteStackManagementController {
         }
 
         self.management_permissions_applied = true;
+        self.management_permissions_revision = super::management_permissions_revision(ctx)?;
 
         Ok(HandlerAction::Continue {
             state: Ready,
@@ -258,6 +263,7 @@ impl AwsRemoteStackManagementController {
             self.reconcile_owned_management_policies(ctx, client.as_ref(), role_name, &[])
                 .await?;
         }
+        self.management_permissions_revision = super::management_permissions_revision(ctx)?;
 
         Ok(HandlerAction::Continue {
             state: Ready,
@@ -481,6 +487,13 @@ impl AwsRemoteStackManagementController {
         status = ResourceStatus::RefreshFailed
     );
 
+    fn needs_update(&self, ctx: &ResourceControllerContext<'_>) -> Result<bool> {
+        super::management_permissions_need_refresh(
+            ctx,
+            self.management_permissions_revision.as_deref(),
+        )
+    }
+
     fn build_outputs(&self) -> Option<ResourceOutputs> {
         if let (Some(role_arn), Some(_role_name)) = (&self.role_arn, &self.role_name) {
             Some(ResourceOutputs::new(RemoteStackManagementOutputs {
@@ -1093,6 +1106,7 @@ impl AwsRemoteStackManagementController {
             role_arn: Some(format!("arn:aws:iam::123456789012:role/{}", role_name)),
             role_name: Some(role_name.to_string()),
             management_permissions_applied: true,
+            management_permissions_revision: None,
             _internal_stay_count: None,
         }
     }
diff --git a/crates/alien-infra/src/remote_stack_management/aws_import.rs b/crates/alien-infra/src/remote_stack_management/aws_import.rs
index 40cb65a0d6..bc6c582dd8 100644
--- a/crates/alien-infra/src/remote_stack_management/aws_import.rs
+++ b/crates/alien-infra/src/remote_stack_management/aws_import.rs
@@ -28,6 +28,8 @@ impl ResourceImporter for AwsRemoteStackManagementImporter {
             role_arn: Some(data.role_arn),
             role_name: Some(data.role_name),
             management_permissions_applied: data.management_permissions_applied,
+            // Setup was applied by an external engine, which refreshes it itself.
+            management_permissions_revision: None,
             _internal_stay_count: None,
         };
         make_imported_state(controller, ctx)
diff --git a/crates/alien-infra/src/remote_stack_management/azure.rs b/crates/alien-infra/src/remote_stack_management/azure.rs
index 4e25641be3..c620dc7851 100644
--- a/crates/alien-infra/src/remote_stack_management/azure.rs
+++ b/crates/alien-infra/src/remote_stack_management/azure.rs
@@ -175,6 +175,10 @@ pub struct AzureRemoteStackManagementController {
     pub(crate) role_assignment_ids: Vec<String>,
     /// Deadline for Azure RBAC propagation after management assignments.
     pub(crate) role_assignment_wait_until_epoch_secs: Option<u64>,
+    /// Revision of the management permissions last assigned. Missing on
+    /// controllers from before revisions were recorded.
+    #[serde(default)]
+    pub(crate) management_permissions_revision: Option<String>,
 }
 
 #[controller]
@@ -567,6 +571,7 @@ impl AzureRemoteStackManagementController {
         }
 
         self.role_assignment_wait_until_epoch_secs = None;
+        self.management_permissions_revision = super::management_permissions_revision(ctx)?;
         Ok(HandlerAction::Continue {
             state: Ready,
             suggested_delay: None,
@@ -973,6 +978,13 @@ impl AzureRemoteStackManagementController {
         status = ResourceStatus::RefreshFailed
     );
 
+    fn needs_update(&self, ctx: &ResourceControllerContext<'_>) -> Result<bool> {
+        super::management_permissions_need_refresh(
+            ctx,
+            self.management_permissions_revision.as_deref(),
+        )
+    }
+
     fn build_outputs(&self) -> Option<ResourceOutputs> {
         if let (Some(client_id), Some(uami_resource_id), Some(tenant_id)) = (
             &self.uami_client_id,
@@ -1695,6 +1707,7 @@ impl AzureRemoteStackManagementController {
             )),
             role_assignment_ids: vec![],
             role_assignment_wait_until_epoch_secs: None,
+            management_permissions_revision: None,
             _internal_stay_count: None,
         }
     }
diff --git a/crates/alien-infra/src/remote_stack_management/azure_import.rs b/crates/alien-infra/src/remote_stack_management/azure_import.rs
index 45884ddec7..76a821ce06 100644
--- a/crates/alien-infra/src/remote_stack_management/azure_import.rs
+++ b/crates/alien-infra/src/remote_stack_management/azure_import.rs
@@ -49,6 +49,8 @@ impl ResourceImporter for AzureRemoteStackManagementImporter {
             role_definition_id: None,
             role_assignment_ids: Vec::new(),
             role_assignment_wait_until_epoch_secs: None,
+            // Setup was applied by an external engine, which refreshes it itself.
+            management_permissions_revision: None,
             _internal_stay_count: None,
         };
         make_imported_state_with_status(controller, ctx, status)
diff --git a/crates/alien-infra/src/remote_stack_management/gcp.rs b/crates/alien-infra/src/remote_stack_management/gcp.rs
index dd30b3f018..b7271e2954 100644
--- a/crates/alien-infra/src/remote_stack_management/gcp.rs
+++ b/crates/alien-infra/src/remote_stack_management/gcp.rs
@@ -42,6 +42,10 @@ pub struct GcpRemoteStackManagementController {
     /// How the deployment names its custom roles, recorded with the service
     /// account. `None` for a service account created before it was recorded.
     pub(crate) custom_role_naming: Option<GcpCustomRoleNaming>,
+    /// Revision of the management permissions last bound. Missing on
+    /// controllers from before revisions were recorded.
+    #[serde(default)]
+    pub(crate) management_permissions_revision: Option<String>,
 }
 
 #[controller]
@@ -295,6 +299,7 @@ impl GcpRemoteStackManagementController {
         }
 
         self.role_bound = true;
+        self.management_permissions_revision = super::management_permissions_revision(ctx)?;
 
         Ok(HandlerAction::Continue {
             state: GrantingImpersonation,
@@ -612,6 +617,13 @@ impl GcpRemoteStackManagementController {
         status = ResourceStatus::RefreshFailed
     );
 
+    fn needs_update(&self, ctx: &ResourceControllerContext<'_>) -> Result<bool> {
+        super::management_permissions_need_refresh(
+            ctx,
+            self.management_permissions_revision.as_deref(),
+        )
+    }
+
     fn build_outputs(&self) -> Option<ResourceOutputs> {
         if let Some(email) = &self.service_account_email {
             Some(ResourceOutputs::new(RemoteStackManagementOutputs {
@@ -823,6 +835,7 @@ impl GcpRemoteStackManagementController {
             role_bound: true,
             impersonation_granted: true,
             custom_role_naming: Some(GcpCustomRoleNaming::HashedLongPrefix),
+            management_permissions_revision: None,
             _internal_stay_count: None,
         }
     }
diff --git a/crates/alien-infra/src/remote_stack_management/gcp_import.rs b/crates/alien-infra/src/remote_stack_management/gcp_import.rs
index f33602a6a2..55ece05ffe 100644
--- a/crates/alien-infra/src/remote_stack_management/gcp_import.rs
+++ b/crates/alien-infra/src/remote_stack_management/gcp_import.rs
@@ -32,6 +32,8 @@ impl ResourceImporter for GcpRemoteStackManagementImporter {
             role_bound: data.management_permissions_applied,
             impersonation_granted: data.management_permissions_applied,
             custom_role_naming: Some(GcpCustomRoleNaming::HashedLongPrefix),
+            // Setup was applied by an external engine, which refreshes it itself.
+            management_permissions_revision: None,
             _internal_stay_count: None,
         };
         make_imported_state(controller, ctx)
diff --git a/crates/alien-infra/src/remote_stack_management/mod.rs b/crates/alien-infra/src/remote_stack_management/mod.rs
index b0d770f3d8..2d2550025c 100644
--- a/crates/alien-infra/src/remote_stack_management/mod.rs
+++ b/crates/alien-infra/src/remote_stack_management/mod.rs
@@ -20,3 +20,142 @@ pub use azure_import::AzureRemoteStackManagementImporter;
 mod test;
 #[cfg(feature = "test")]
 pub use test::*;
+
+use crate::core::ResourceControllerContext;
+use crate::error::{ErrorData, Result};
+use alien_core::InitialSetupAuthority;
+use alien_error::{Context, IntoAlienError};
+use alien_permissions::get_permission_set;
+use sha2::{Digest, Sha256};
+
+/// A revision of the management permissions the stack asks for: a digest of
+/// the management profile with every permission set it names resolved to its
+/// body. A release that changes a permission set changes the revision.
+pub(crate) fn management_permissions_revision(
+    ctx: &ResourceControllerContext<'_>,
+) -> Result<Option<String>> {
+    let Some(profile) = ctx.desired_stack.management().profile() else {
+        return Ok(None);
+    };
+    let resolved = profile
+        .0
+        .iter()
+        .map(|(scope, references)| {
+            let sets = references
+                .iter()
+                .map(|reference| reference.resolve(|name| get_permission_set(name).cloned()))
+                .collect::<Vec<_>>();
+            (scope, sets)
+        })
+        .collect::<Vec<_>>();
+    let serialized = serde_json::to_vec(&resolved)
+        .into_alien_error()
+        .context(ErrorData::InfrastructureError {
+            message: "Failed to serialize the management permissions".to_string(),
+            operation: Some("management_permissions_revision".to_string()),
+            resource_id: None,
+        })?;
+    Ok(Some(format!("{:x}", Sha256::digest(&serialized))))
+}
+
+/// Whether the management identity's permissions should be refreshed.
+///
+/// Management permissions are installed by setup and never refreshed by a
+/// release update. Only an Alien direct setup (administrator credentials,
+/// `alien deploy`) re-applies them when they changed; under runtime
+/// credentials this is never true, because the runtime may not change its
+/// own role and the update executor includes Frozen resources.
+pub(crate) fn management_permissions_need_refresh(
+    ctx: &ResourceControllerContext<'_>,
+    applied_revision: Option<&str>,
+) -> Result<bool> {
+    if ctx.initial_setup_authority != InitialSetupAuthority::DirectSetup {
+        return Ok(false);
+    }
+    Ok(management_permissions_revision(ctx)?.as_deref() != applied_revision)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::core::controller_test::SingleControllerExecutor;
+    use crate::core::ResourceController;
+    use crate::{
+        AwsRemoteStackManagementController, AzureRemoteStackManagementController,
+        GcpRemoteStackManagementController,
+    };
+    use alien_core::{Platform, RemoteStackManagement};
+
+    async fn executor(
+        platform: Platform,
+        controller: impl ResourceController + 'static,
+        authority: InitialSetupAuthority,
+    ) -> SingleControllerExecutor {
+        SingleControllerExecutor::builder()
+            .resource(RemoteStackManagement::new("management".to_string()).build())
+            .controller(controller)
+            .platform(platform)
+            .initial_setup_authority(authority)
+            .build()
+            .await
+            .expect("executor builds")
+    }
+
+    /// Per cloud: a controller that applied `applied` revision.
+    async fn needs_update(
+        platform: Platform,
+        authority: InitialSetupAuthority,
+        applied: Option<&str>,
+    ) -> (bool, String) {
+        let applied = applied.map(str::to_string);
+        let executor = match platform {
+            Platform::Aws => {
+                let mut controller = AwsRemoteStackManagementController::mock_ready("test");
+                controller.management_permissions_revision = applied;
+                executor(platform, controller, authority).await
+            }
+            Platform::Gcp => {
+                let mut controller = GcpRemoteStackManagementController::mock_ready("test");
+                controller.management_permissions_revision = applied;
+                executor(platform, controller, authority).await
+            }
+            Platform::Azure => {
+                let mut controller = AzureRemoteStackManagementController::mock_ready("test");
+                controller.management_permissions_revision = applied;
+                executor(platform, controller, authority).await
+            }
+            other => panic!("no remote stack management controller for {other:?}"),
+        };
+        let current = executor
+            .with_context(management_permissions_revision)
+            .expect("revision")
+            .expect("the test stack has a management profile");
+        (executor.needs_update().expect("needs_update"), current)
+    }
+
+    #[tokio::test]
+    async fn direct_setup_refreshes_management_permissions_that_changed() {
+        for platform in [Platform::Aws, Platform::Gcp, Platform::Azure] {
+            let (stale, current) =
+                needs_update(platform, InitialSetupAuthority::DirectSetup, Some("stale")).await;
+            assert!(stale, "{platform:?}: a changed revision is refreshed");
+            let (legacy, _) =
+                needs_update(platform, InitialSetupAuthority::DirectSetup, None).await;
+            assert!(legacy, "{platform:?}: an install without a recorded revision is refreshed");
+            let (unchanged, _) =
+                needs_update(platform, InitialSetupAuthority::DirectSetup, Some(&current)).await;
+            assert!(!unchanged, "{platform:?}: the applied revision is left alone");
+        }
+    }
+
+    #[tokio::test]
+    async fn runtime_credentials_never_refresh_management_permissions() {
+        for platform in [Platform::Aws, Platform::Gcp, Platform::Azure] {
+            for applied in [Some("stale"), None] {
+                let (refresh, _) =
+                    needs_update(platform, InitialSetupAuthority::ImportedHandoff, applied).await;
+                assert!(!refresh, "{platform:?} with {applied:?}");
+            }
+        }
+    }
+}
diff --git a/crates/alien-manager/src/loops/deployment.rs b/crates/alien-manager/src/loops/deployment.rs
index be3493d601..bfff163382 100644
--- a/crates/alien-manager/src/loops/deployment.rs
+++ b/crates/alien-manager/src/loops/deployment.rs
@@ -725,6 +725,7 @@ impl DeploymentLoop {
                 manager_url: Some(self.config.base_url()),
                 deployment_token: deployment.deployment_token.clone(),
                 native_image_host,
+                volume_restores: Vec::new(),
             }
         };
 
diff --git a/crates/alien-manager/src/routes/stack.rs b/crates/alien-manager/src/routes/stack.rs
index 94f7fa22b9..5488fb46c9 100644
--- a/crates/alien-manager/src/routes/stack.rs
+++ b/crates/alien-manager/src/routes/stack.rs
@@ -1344,6 +1344,7 @@ async fn prepare_import_stack(
         manager_url: None,
         deployment_token: None,
         native_image_host: None,
+        volume_restores: Vec::new(),
     };
 
     runner
diff --git a/crates/alien-manager/src/routes/sync.rs b/crates/alien-manager/src/routes/sync.rs
index 8ca6e8a29e..e5494795ca 100644
--- a/crates/alien-manager/src/routes/sync.rs
+++ b/crates/alien-manager/src/routes/sync.rs
@@ -1455,6 +1455,7 @@ mod tests {
             manager_url: None,
             deployment_token: None,
             native_image_host: None,
+            volume_restores: Vec::new(),
         }
     }
 
@@ -2270,6 +2271,11 @@ fn build_target_deployment_config(
         .maybe_manager_url(Some(manager_url))
         .maybe_deployment_token(agent_token)
         .maybe_native_image_host(native_image_host)
+        .volume_restores(
+            deployment_config
+                .map(|config| config.volume_restores.clone())
+                .unwrap_or_default(),
+        )
         .build()
 }
 
diff --git a/crates/alien-operator/src/loops/deployment.rs b/crates/alien-operator/src/loops/deployment.rs
index 1c21415a61..73b7dbfffe 100644
--- a/crates/alien-operator/src/loops/deployment.rs
+++ b/crates/alien-operator/src/loops/deployment.rs
@@ -505,6 +505,7 @@ mod tests {
             manager_url: None,
             deployment_token: None,
             native_image_host: None,
+            volume_restores: Vec::new(),
         }
     }
 
diff --git a/crates/alien-permissions/permission-sets/container/management.jsonc b/crates/alien-permissions/permission-sets/container/management.jsonc
index 79fe022af7..31d531e784 100644
--- a/crates/alien-permissions/permission-sets/container/management.jsonc
+++ b/crates/alien-permissions/permission-sets/container/management.jsonc
@@ -11,7 +11,8 @@
             "elasticloadbalancing:DescribeTargetGroups",
             "elasticloadbalancing:DescribeTargetHealth",
             "elasticloadbalancing:DescribeListeners",
-            "ec2:DescribeVolumes"
+            "ec2:DescribeVolumes",
+            "ec2:DescribeSnapshots"
           ]
         },
         "binding": {
@@ -136,9 +137,38 @@
             "scope": "projects/${projectName}"
           }
         }
+      },
+      // Volume backups: report each volume's latest snapshot (status only; schedule
+      // changes, snapshots and restores use container/provision).
+      {
+        "grant": {
+          "permissions": ["compute.snapshots.list"]
+        },
+        "binding": {
+          "stack": {
+            "scope": "projects/${projectName}"
+          },
+          "resource": {
+            "scope": "projects/${projectName}"
+          }
+        }
       }
     ],
     "azure": [
+      // Volume backup status: list the container's snapshots to report the newest one per replica
+      {
+        "grant": {
+          "actions": ["Microsoft.Compute/snapshots/read"]
+        },
+        "binding": {
+          "stack": {
+            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}"
+          },
+          "resource": {
+            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}"
+          }
+        }
+      },
       // Read-only inspection of LB and disk resources
       {
         "grant": {
diff --git a/crates/alien-permissions/permission-sets/container/provision.jsonc b/crates/alien-permissions/permission-sets/container/provision.jsonc
index 070ccdb273..895090ee13 100644
--- a/crates/alien-permissions/permission-sets/container/provision.jsonc
+++ b/crates/alien-permissions/permission-sets/container/provision.jsonc
@@ -140,7 +140,7 @@
       },
       {
         "grant": {
-          "actions": ["ec2:DeleteVolume"]
+          "actions": ["ec2:DeleteVolume", "ec2:ModifyVolume"]
         },
         "binding": {
           "stack": {
@@ -164,11 +164,358 @@
           }
         }
       },
+      // Volume backups: a snapshot of an owned volume (final snapshot on delete,
+      // and of the replaced volume on restore). AWS authorizes CreateSnapshot against
+      // both the source volume and the new snapshot.
+      {
+        "grant": {
+          "actions": ["ec2:CreateSnapshot"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:ec2:${awsRegion}:${awsAccountId}:volume/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:ec2:${awsRegion}:${awsAccountId}:volume/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${resourceTag}": "${resourceId}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              }
+            }
+          }
+        }
+      },
+      {
+        "grant": {
+          "actions": ["ec2:CreateSnapshot"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:ec2:${awsRegion}::snapshot/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${managedByTag}": "runtime"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:ec2:${awsRegion}::snapshot/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${resourceTag}": "${resourceId}",
+                "aws:RequestTag/${managedByTag}": "runtime"
+              }
+            }
+          }
+        }
+      },
+      {
+        "grant": {
+          "actions": ["ec2:CreateTags"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:ec2:${awsRegion}::snapshot/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${managedByTag}": "runtime",
+                "ec2:CreateAction": "CreateSnapshot"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:ec2:${awsRegion}::snapshot/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${resourceTag}": "${resourceId}",
+                "aws:RequestTag/${managedByTag}": "runtime",
+                "ec2:CreateAction": "CreateSnapshot"
+              }
+            }
+          }
+        }
+      },
+      // Scheduled snapshots copy the volume's tags, so they carry the same boundary tags.
+      {
+        "grant": {
+          "actions": ["ec2:DeleteSnapshot"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:ec2:${awsRegion}::snapshot/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:ec2:${awsRegion}::snapshot/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${resourceTag}": "${resourceId}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              }
+            }
+          }
+        }
+      },
+      // Restore: a new volume made from one of this stack's snapshots.
+      {
+        "grant": {
+          "actions": ["ec2:CreateVolume"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:ec2:${awsRegion}::snapshot/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:ec2:${awsRegion}::snapshot/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${resourceTag}": "${resourceId}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              }
+            }
+          }
+        }
+      },
+      // Restore: the restored volume's marker tag is removed once it replaces the old one.
+      {
+        "grant": {
+          "actions": ["ec2:DeleteTags"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:ec2:${awsRegion}:${awsAccountId}:volume/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              },
+              "ForAllValues:StringEquals": {
+                "aws:TagKeys": "alien-restore-request"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:ec2:${awsRegion}:${awsAccountId}:volume/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${resourceTag}": "${resourceId}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              },
+              "ForAllValues:StringEquals": {
+                "aws:TagKeys": "alien-restore-request"
+              }
+            }
+          }
+        }
+      },
+      // Scheduled snapshots: one Data Lifecycle Manager policy per container.
+      // AWS authorizes CreateLifecyclePolicy against no resource type, so only the
+      // request tags can bound it. Its implicit TagResource is authorized on the policy.
+      {
+        "grant": {
+          "actions": ["dlm:CreateLifecyclePolicy"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${managedByTag}": "runtime"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${resourceTag}": "${resourceId}",
+                "aws:RequestTag/${managedByTag}": "runtime"
+              }
+            }
+          }
+        }
+      },
+      {
+        "grant": {
+          "actions": ["dlm:TagResource"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:dlm:${awsRegion}:${awsAccountId}:policy/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${managedByTag}": "runtime"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:dlm:${awsRegion}:${awsAccountId}:policy/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${resourceTag}": "${resourceId}",
+                "aws:RequestTag/${managedByTag}": "runtime"
+              }
+            }
+          }
+        }
+      },
+      {
+        "grant": {
+          "actions": [
+            "dlm:GetLifecyclePolicy",
+            "dlm:UpdateLifecyclePolicy",
+            "dlm:DeleteLifecyclePolicy"
+          ]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:dlm:${awsRegion}:${awsAccountId}:policy/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:dlm:${awsRegion}:${awsAccountId}:policy/*"],
+            "condition": {
+              "StringEquals": {
+                "aws:ResourceTag/${stackTag}": "${stackPrefix}",
+                "aws:ResourceTag/${resourceTag}": "${resourceId}",
+                "aws:ResourceTag/${managedByTag}": "runtime"
+              }
+            }
+          }
+        }
+      },
+      // The policy's execution role `${stackPrefix}-dlm-{hash of prefix and container}`,
+      // trusted by dlm.amazonaws.com, with only the AWS managed DLM service policy
+      // attached. The calls on an existing role are scoped by name, not tags: IAM
+      // answers a tag-conditioned call on a role that does not exist with
+      // AccessDenied, and cleanup must see NoSuchEntity to treat it as already gone.
+      {
+        "grant": {
+          "actions": ["iam:CreateRole", "iam:TagRole"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${managedByTag}": "runtime"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"],
+            "condition": {
+              "StringEquals": {
+                "aws:RequestTag/${stackTag}": "${stackPrefix}",
+                "aws:RequestTag/${resourceTag}": "${resourceId}",
+                "aws:RequestTag/${managedByTag}": "runtime"
+              }
+            }
+          }
+        }
+      },
+      {
+        "grant": {
+          "actions": ["iam:GetRole", "iam:DetachRolePolicy", "iam:DeleteRole"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"]
+          },
+          "resource": {
+            "resources": ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"]
+          }
+        }
+      },
+      {
+        "grant": {
+          "actions": ["iam:AttachRolePolicy"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"],
+            "condition": {
+              "StringEquals": {
+                "iam:PolicyARN": "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"],
+            "condition": {
+              "StringEquals": {
+                "iam:PolicyARN": "arn:aws:iam::aws:policy/service-role/AWSDataLifecycleManagerServiceRole"
+              }
+            }
+          }
+        }
+      },
+      {
+        "grant": {
+          "actions": ["iam:PassRole"]
+        },
+        "binding": {
+          "stack": {
+            "resources": ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"],
+            "condition": {
+              "StringEquals": {
+                "iam:PassedToService": "dlm.amazonaws.com"
+              }
+            }
+          },
+          "resource": {
+            "resources": ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"],
+            "condition": {
+              "StringEquals": {
+                "iam:PassedToService": "dlm.amazonaws.com"
+              }
+            }
+          }
+        }
+      },
       {
         // AWS requires Resource: "*" for these read APIs.
         "grant": {
           "actions": [
             "ec2:DescribeVolumes",
+            "ec2:DescribeSnapshots",
+            "dlm:GetLifecyclePolicies",
             "elasticloadbalancing:DescribeLoadBalancers",
             "elasticloadbalancing:DescribeTargetGroups",
             "elasticloadbalancing:DescribeTargetHealth",
@@ -462,6 +809,39 @@
             "scope": "projects/${projectName}"
           }
         }
+      },
+      // Volume backups: a snapshot schedule (regional resource policy) attached to
+      // each disk, a final snapshot of each disk on delete, cleanup of scheduled
+      // snapshots, and restoring a disk from a snapshot.
+      {
+        "grant": {
+          "permissions": [
+            "compute.resourcePolicies.create",
+            "compute.resourcePolicies.delete",
+            "compute.resourcePolicies.get",
+            "compute.resourcePolicies.use",
+            "compute.disks.addResourcePolicies",
+            "compute.disks.removeResourcePolicies",
+            "compute.disks.createSnapshot",
+            "compute.snapshots.create",
+            "compute.snapshots.delete",
+            "compute.snapshots.get",
+            "compute.snapshots.list",
+            "compute.snapshots.setLabels",
+            "compute.snapshots.useReadOnly",
+            "compute.regionOperations.get",
+            "compute.zoneOperations.get"
+          ]
+        },
+        // Compute Engine uses project NAME in resource.name (not number).
+        "binding": {
+          "stack": {
+            "scope": "projects/${projectName}"
+          },
+          "resource": {
+            "scope": "projects/${projectName}"
+          }
+        }
       }
     ],
     "azure": [
@@ -516,6 +896,47 @@
           }
         }
       },
+      // Volume backups and restores: an Azure Disk Backup vault per container with its policy and
+      // one backup instance per disk (suspended, not deleted, when backups are turned off), the
+      // final snapshot taken on delete, and the snapshot of a disk replaced by a restore. The
+      // restored disk itself uses the Managed Disks grant above. The vault identity's role
+      // assignments (Disk Backup Reader on each disk, Disk Snapshot Contributor on the resource
+      // group) use the roleAssignments grants above. The vault identity reads disk contents;
+      // this identity never does, so no beginGetAccess.
+      {
+        "grant": {
+          "actions": [
+            "Microsoft.DataProtection/backupVaults/read",
+            "Microsoft.DataProtection/backupVaults/write",
+            "Microsoft.DataProtection/backupVaults/delete",
+            "Microsoft.DataProtection/backupVaults/operationResults/read",
+            "Microsoft.DataProtection/backupVaults/operationStatus/read",
+            "Microsoft.DataProtection/backupVaults/backupPolicies/read",
+            "Microsoft.DataProtection/backupVaults/backupPolicies/write",
+            "Microsoft.DataProtection/backupVaults/backupPolicies/delete",
+            "Microsoft.DataProtection/backupVaults/validateForBackup/action",
+            "Microsoft.DataProtection/backupVaults/backupInstances/read",
+            "Microsoft.DataProtection/backupVaults/backupInstances/write",
+            "Microsoft.DataProtection/backupVaults/backupInstances/delete",
+            "Microsoft.DataProtection/backupVaults/backupInstances/suspendBackups/action",
+            "Microsoft.DataProtection/backupVaults/backupInstances/resumeBackups/action",
+            "Microsoft.DataProtection/backupVaults/backupInstances/operationResults/read",
+            "Microsoft.DataProtection/locations/operationStatus/read",
+            "Microsoft.DataProtection/locations/operationResults/read",
+            "Microsoft.Compute/snapshots/read",
+            "Microsoft.Compute/snapshots/write",
+            "Microsoft.Compute/snapshots/delete"
+          ]
+        },
+        "binding": {
+          "stack": {
+            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}"
+          },
+          "resource": {
+            "scope": "/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}"
+          }
+        }
+      },
       // Key Vault certificate for HTTPS containers
       {
         "grant": {
diff --git a/crates/alien-permissions/tests/aws_abac_validation.rs b/crates/alien-permissions/tests/aws_abac_validation.rs
index aa6f8b210b..7c26b60cf9 100644
--- a/crates/alien-permissions/tests/aws_abac_validation.rs
+++ b/crates/alien-permissions/tests/aws_abac_validation.rs
@@ -730,6 +730,7 @@ fn action_requires_tag_condition(action: &str) -> bool {
             | "apigateway:PUT"
             | "apigateway:TagResource"
             | "autoscaling:CreateAutoScalingGroup"
+            | "dlm:CreateLifecyclePolicy"
             | "autoscaling:DeleteAutoScalingGroup"
             | "autoscaling:SetDesiredCapacity"
             | "autoscaling:StartInstanceRefresh"
@@ -1038,3 +1039,57 @@ fn no_sandbox_set_can_pass_a_role_into_a_session() {
 
     assert!(inspected > 0, "no sandbox permission set was inspected");
 }
+
+/// IAM answers a call whose grant is conditioned on `aws:ResourceTag` with AccessDenied when the
+/// role does not exist, because a missing role has no tags to match. Container cleanup deletes
+/// the volume-backup execution role whether or not it exists, and only `NoSuchEntity` tells it
+/// the role is already gone. So every call on that existing role must be scoped by name alone.
+#[test]
+fn container_backup_role_calls_on_existing_roles_are_name_scoped() {
+    let permission_set = get_permission_set("container/provision").expect("container/provision");
+    let aws_permissions = permission_set
+        .platforms
+        .aws
+        .as_ref()
+        .expect("container/provision has AWS permissions");
+    let existing_role_actions = [
+        "iam:GetRole",
+        "iam:AttachRolePolicy",
+        "iam:DetachRolePolicy",
+        "iam:DeleteRole",
+        "iam:PassRole",
+    ];
+    for action in existing_role_actions {
+        let statements = aws_permissions
+            .iter()
+            .filter(|permission| {
+                permission
+                    .grant
+                    .actions
+                    .iter()
+                    .flatten()
+                    .any(|granted| granted == action)
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(statements.len(), 1, "{action} should be granted once");
+        for binding in [
+            statements[0].binding.stack.as_ref(),
+            statements[0].binding.resource.as_ref(),
+        ]
+        .into_iter()
+        .flatten()
+        {
+            assert_eq!(
+                binding.resources,
+                ["arn:aws:iam::${awsAccountId}:role/${stackPrefix}-dlm-*"],
+                "{action} must cover the controller's role name `{{prefix}}-dlm-{{hash}}`"
+            );
+            assert!(
+                !has_condition_key(binding, "aws:ResourceTag/${stackTag}")
+                    && !has_condition_key(binding, "aws:ResourceTag/${resourceTag}")
+                    && !has_condition_key(binding, "aws:ResourceTag/${managedByTag}"),
+                "{action} must not depend on the role's tags"
+            );
+        }
+    }
+}
diff --git a/crates/alien-preflights/src/compile_time/mod.rs b/crates/alien-preflights/src/compile_time/mod.rs
index aeac39b861..1b230d1f2a 100644
--- a/crates/alien-preflights/src/compile_time/mod.rs
+++ b/crates/alien-preflights/src/compile_time/mod.rs
@@ -28,6 +28,7 @@ pub mod stack_inputs;
 pub mod trigger_edge_ownership;
 pub mod unique_endpoint_host_labels;
 pub mod unique_resources;
+pub mod volume_backups;
 pub mod valid_resource_dependencies;
 pub mod worker_memory;
 
@@ -58,6 +59,7 @@ pub use unique_endpoint_host_labels::{
     endpoint_host_label_conflicts, UniqueEndpointHostLabelsCheck,
 };
 pub use unique_resources::UniqueResourcesCheck;
+pub use volume_backups::VolumeBackupsCheck;
 pub use valid_resource_dependencies::{
     validate_stack_dependencies, ValidResourceDependenciesCheck,
 };
diff --git a/crates/alien-preflights/src/compile_time/volume_backups.rs b/crates/alien-preflights/src/compile_time/volume_backups.rs
new file mode 100644
index 0000000000..8e08a22650
--- /dev/null
+++ b/crates/alien-preflights/src/compile_time/volume_backups.rs
@@ -0,0 +1,175 @@
+use crate::{CheckResult, CompileTimeCheck};
+use alien_core::{Container, Platform, Stack};
+use async_trait::async_trait;
+
+/// Validates the snapshot schedule of each persistent volume.
+///
+/// The schedule has to fit every cloud's native snapshot scheduler, so a stack
+/// that deploys to one cloud also deploys to the others.
+pub struct VolumeBackupsCheck;
+
+#[async_trait]
+impl CompileTimeCheck for VolumeBackupsCheck {
+    fn description(&self) -> &'static str {
+        "Validate persistent volume backup schedules"
+    }
+
+    fn should_run(&self, stack: &Stack, _platform: Platform) -> bool {
+        stack.resources().any(|(_, entry)| {
+            entry
+                .config
+                .downcast_ref::<Container>()
+                .is_some_and(|container| container.persistent_storage.is_some())
+        })
+    }
+
+    async fn check(&self, stack: &Stack, _platform: Platform) -> crate::error::Result<CheckResult> {
+        let failures: Vec<String> = stack
+            .resources()
+            .filter_map(|(_, entry)| entry.config.downcast_ref::<Container>())
+            .filter_map(|container| {
+                let storage = container.persistent_storage.as_ref()?;
+                let reason = storage.backups.validation_error()?;
+                Some(format!("Container '{}': {reason}", container.id))
+            })
+            .collect();
+
+        if failures.is_empty() {
+            Ok(CheckResult::success())
+        } else {
+            Ok(CheckResult::failed(failures))
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use alien_core::{
+        ContainerCode, PersistentStorage, ResourceLifecycle, ResourceSpec, VolumeBackups,
+    };
+
+    fn stack_with_backups(backups: VolumeBackups) -> Stack {
+        let container = Container::new("db".to_string())
+            .code(ContainerCode::Image {
+                image: "postgres:16".to_string(),
+            })
+            .cpu(ResourceSpec {
+                min: "1".to_string(),
+                desired: "1".to_string(),
+            })
+            .memory(ResourceSpec {
+                min: "1Gi".to_string(),
+                desired: "1Gi".to_string(),
+            })
+            .port(5432)
+            .replicas(1)
+            .persistent_storage(PersistentStorage {
+                size: "20Gi".to_string(),
+                mount_path: "/data".to_string(),
+                backups,
+            })
+            .stateful(true)
+            .permissions("execution".to_string())
+            .build();
+        Stack::new("test".to_string())
+            .add(container, ResourceLifecycle::Live)
+            .build()
+    }
+
+    async fn errors_for(backups: VolumeBackups) -> Vec<String> {
+        VolumeBackupsCheck
+            .check(&stack_with_backups(backups), Platform::Aws)
+            .await
+            .expect("check should run")
+            .errors
+    }
+
+    #[tokio::test]
+    async fn accepts_defaults_and_disabled_backups() {
+        assert!(errors_for(VolumeBackups::default()).await.is_empty());
+        // A disabled schedule is never sent to a cloud, so its numbers don't matter.
+        assert!(errors_for(VolumeBackups {
+            enabled: false,
+            interval_hours: 5,
+            retention_days: 0,
+        })
+        .await
+        .is_empty());
+    }
+
+    #[tokio::test]
+    async fn rejects_intervals_some_cloud_cannot_schedule() {
+        // AWS accepts 3 hours but Azure Disk Backup does not.
+        let errors = errors_for(VolumeBackups {
+            enabled: true,
+            interval_hours: 3,
+            retention_days: 7,
+        })
+        .await;
+        assert_eq!(errors.len(), 1);
+        assert!(errors[0].starts_with("Container 'db': backup intervalHours must be one of"));
+    }
+
+    #[tokio::test]
+    async fn rejects_more_snapshots_than_a_disk_can_hold() {
+        // Hourly for 18 days is 432 snapshots; 19 days is 456, over the 450 limit.
+        assert!(errors_for(VolumeBackups {
+            enabled: true,
+            interval_hours: 1,
+            retention_days: 18,
+        })
+        .await
+        .is_empty());
+        let errors = errors_for(VolumeBackups {
+            enabled: true,
+            interval_hours: 1,
+            retention_days: 19,
+        })
+        .await;
+        assert_eq!(
+            errors,
+            vec![
+                "Container 'db': backups every 1 hours for 19 days keep 456 snapshots per volume; \
+                 the most is 450"
+                    .to_string()
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn rejects_retention_longer_than_a_year() {
+        // Daily for 450 days is 450 snapshots, but Azure keeps snapshots for a year at most.
+        assert!(errors_for(VolumeBackups {
+            enabled: true,
+            interval_hours: 24,
+            retention_days: 365,
+        })
+        .await
+        .is_empty());
+        let errors = errors_for(VolumeBackups {
+            enabled: true,
+            interval_hours: 24,
+            retention_days: 450,
+        })
+        .await;
+        assert_eq!(
+            errors,
+            vec!["Container 'db': backup retentionDays must be at most 365, got 450".to_string()]
+        );
+    }
+
+    #[tokio::test]
+    async fn rejects_zero_retention() {
+        let errors = errors_for(VolumeBackups {
+            enabled: true,
+            interval_hours: 24,
+            retention_days: 0,
+        })
+        .await;
+        assert_eq!(
+            errors,
+            vec!["Container 'db': backup retentionDays must be at least 1".to_string()]
+        );
+    }
+}
diff --git a/crates/alien-preflights/src/deployment_prerequisites.rs b/crates/alien-preflights/src/deployment_prerequisites.rs
index e9d1e49e0c..34b92d92a8 100644
--- a/crates/alien-preflights/src/deployment_prerequisites.rs
+++ b/crates/alien-preflights/src/deployment_prerequisites.rs
@@ -750,6 +750,7 @@ mod tests {
             manager_url: None,
             deployment_token: None,
             native_image_host: None,
+            volume_restores: Vec::new(),
         }
     }
 
diff --git a/crates/alien-preflights/src/lib.rs b/crates/alien-preflights/src/lib.rs
index 91de3ac640..a83ef40851 100644
--- a/crates/alien-preflights/src/lib.rs
+++ b/crates/alien-preflights/src/lib.rs
@@ -371,6 +371,7 @@ impl PreflightRegistry {
         registry.add_compile_time_check(Box::new(compile_time::ResourceNameLengthCheck));
         registry.add_compile_time_check(Box::new(compile_time::ResourceIdPatternCheck));
         registry.add_compile_time_check(Box::new(compile_time::WorkerMemoryCheck));
+        registry.add_compile_time_check(Box::new(compile_time::VolumeBackupsCheck));
         registry.add_compile_time_check(Box::new(
             compile_time::kubernetes_compute::KubernetesComputeCheck,
         ));
diff --git a/crates/alien-preflights/src/mutations/compute_cluster.rs b/crates/alien-preflights/src/mutations/compute_cluster.rs
index fd7380710e..7bcdd85940 100644
--- a/crates/alien-preflights/src/mutations/compute_cluster.rs
+++ b/crates/alien-preflights/src/mutations/compute_cluster.rs
@@ -1021,7 +1021,7 @@ mod tests {
     use alien_core::{
         compute_planner::plan_compute, ComputeChoiceRange, ComputePoolSelection, ComputeSettings,
         ContainerAutoscaling, ContainerCode, DaemonCode, EnvironmentVariablesSnapshot,
-        ExternalBindings, FailureDomainSelection, NetworkSettings, PersistentStorage, ResourceSpec,
+        ExternalBindings, FailureDomainSelection, NetworkSettings, PersistentStorage, ResourceSpec, VolumeBackups,
         StackSettings,
     };
     use indexmap::IndexMap;
@@ -1068,6 +1068,7 @@ mod tests {
             .persistent_storage(PersistentStorage {
                 size: "20Gi".to_string(),
                 mount_path: "/data".to_string(),
+                backups: VolumeBackups::default(),
             })
             .stateful(true)
             .replicas(3)
@@ -1326,6 +1327,7 @@ mod tests {
             .persistent_storage(PersistentStorage {
                 size: "20Gi".to_string(),
                 mount_path: "/data".to_string(),
+                backups: VolumeBackups::default(),
             })
             .stateful(true)
             .replicas(1)
@@ -1386,6 +1388,7 @@ mod tests {
             .persistent_storage(PersistentStorage {
                 size: "20Gi".to_string(),
                 mount_path: "/data".to_string(),
+                backups: VolumeBackups::default(),
             })
             .stateful(true)
             .replicas(1)
diff --git a/crates/alien-preflights/src/mutations/kubernetes_cluster.rs b/crates/alien-preflights/src/mutations/kubernetes_cluster.rs
index a4a9c15105..cfc810be35 100644
--- a/crates/alien-preflights/src/mutations/kubernetes_cluster.rs
+++ b/crates/alien-preflights/src/mutations/kubernetes_cluster.rs
@@ -213,6 +213,7 @@ mod tests {
             manager_url: None,
             deployment_token: None,
             native_image_host: None,
+            volume_restores: Vec::new(),
         }
     }
 
diff --git a/crates/alien-preflights/src/mutations/remote_bindings.rs b/crates/alien-preflights/src/mutations/remote_bindings.rs
index 8eda822c75..57261b3a86 100644
--- a/crates/alien-preflights/src/mutations/remote_bindings.rs
+++ b/crates/alien-preflights/src/mutations/remote_bindings.rs
@@ -361,6 +361,7 @@ mod tests {
             manager_url: None,
             deployment_token: None,
             native_image_host: None,
+            volume_restores: Vec::new(),
         }
     }
 
diff --git a/crates/alien-preflights/src/mutations/remote_stack_management.rs b/crates/alien-preflights/src/mutations/remote_stack_management.rs
index 21a563f427..ab0cfd381f 100644
--- a/crates/alien-preflights/src/mutations/remote_stack_management.rs
+++ b/crates/alien-preflights/src/mutations/remote_stack_management.rs
@@ -160,6 +160,7 @@ mod tests {
             manager_url: None,
             deployment_token: None,
             native_image_host: None,
+            volume_restores: Vec::new(),
         }
     }
 
diff --git a/crates/alien-preflights/tests/built_in_permission_bodies.rs b/crates/alien-preflights/tests/built_in_permission_bodies.rs
index e236788b23..c6d888d3eb 100644
--- a/crates/alien-preflights/tests/built_in_permission_bodies.rs
+++ b/crates/alien-preflights/tests/built_in_permission_bodies.rs
@@ -13,7 +13,7 @@ use alien_core::{
         ManagementPermissions, PermissionProfile, PermissionSetReference, PermissionsConfig,
     },
     AwsManagementConfig, ComputeSettings, Container, ContainerCode, DeploymentConfig,
-    EnvironmentVariablesSnapshot, ExternalBindings, ManagementConfig, PersistentStorage, Platform,
+    EnvironmentVariablesSnapshot, ExternalBindings, ManagementConfig, PersistentStorage, Platform, VolumeBackups,
     ResourceLifecycle, ResourceSpec, Stack, StackSettings, StackState,
 };
 use alien_preflights::runner::PreflightRunner;
@@ -38,6 +38,7 @@ fn container(id: &str, persistent: bool) -> Container {
             .persistent_storage(PersistentStorage {
                 size: "20Gi".to_string(),
                 mount_path: "/data".to_string(),
+                backups: VolumeBackups::default(),
             })
             .stateful(true)
             .replicas(1)
diff --git a/crates/alien-test/src/deployment.rs b/crates/alien-test/src/deployment.rs
index bc77433043..b101f9d252 100644
--- a/crates/alien-test/src/deployment.rs
+++ b/crates/alien-test/src/deployment.rs
@@ -595,6 +595,8 @@ wait "$child_pid"
             desired_replicas: 1,
             internal_dns: "api".to_string(),
             replicas: Vec::new(),
+            volumes: Vec::new(),
+            volume_backups: None,
             public_endpoints: std::collections::HashMap::from([(
                 "api".to_string(),
                 alien_core::PublicEndpointOutput {
@@ -626,6 +628,8 @@ wait "$child_pid"
             desired_replicas: 1,
             internal_dns: "api".to_string(),
             replicas: Vec::new(),
+            volumes: Vec::new(),
+            volume_backups: None,
             public_endpoints: std::collections::HashMap::new(),
         });
 
diff --git a/crates/alien-test/src/distribution.rs b/crates/alien-test/src/distribution.rs
index 806738acec..0e699da409 100644
--- a/crates/alien-test/src/distribution.rs
+++ b/crates/alien-test/src/distribution.rs
@@ -1075,6 +1075,7 @@ async fn apply_render_mutations_with_management_config(
         manager_url: None,
         deployment_token: None,
         native_image_host: None,
+        volume_restores: Vec::new(),
     };
 
     runner
@@ -1964,6 +1965,7 @@ async fn terraform_kubernetes_stack_for_target(
         manager_url: None,
         deployment_token: None,
         native_image_host: None,
+        volume_restores: Vec::new(),
     };
 
     runner
diff --git a/packages/core/src/__tests__/stack.test.ts b/packages/core/src/__tests__/stack.test.ts
index 4f8046a5ff..13979e2b37 100644
--- a/packages/core/src/__tests__/stack.test.ts
+++ b/packages/core/src/__tests__/stack.test.ts
@@ -286,6 +286,28 @@ describe("Stack builder validation", () => {
     })
   })
 
+  it("sets or turns off persistent volume backups", () => {
+    const base = () =>
+      new alien.Container("db")
+        .code({ type: "image", image: "postgres:16-alpine" })
+        .cpu(0.5)
+        .memory("512Mi")
+        .port(5432)
+        .permissions("database")
+
+    const hourly = base()
+      .persistentStorage("20Gi", { backups: { intervalHours: 1, retentionDays: 3 } })
+      .build()
+    expect(hourly.config.persistentStorage?.backups).toEqual({
+      enabled: true,
+      intervalHours: 1,
+      retentionDays: 3,
+    })
+
+    const off = base().persistentStorage("20Gi", { backups: false }).build()
+    expect(off.config.persistentStorage?.backups?.enabled).toBe(false)
+  })
+
   it("builds container and daemon stop grace periods", () => {
     const container = new alien.Container("api")
       .code({ type: "image", image: "nginx:latest" })
diff --git a/packages/core/src/container.ts b/packages/core/src/container.ts
index f8a6e217cd..1dd3665e52 100644
--- a/packages/core/src/container.ts
+++ b/packages/core/src/container.ts
@@ -58,6 +58,25 @@ export interface PersistentStorageOptions {
    * Defaults to `/data`.
    */
   mountPath?: string
+  /**
+   * Scheduled snapshots of each replica's volume, taken by the cloud's own
+   * scheduler. On by default: every 24 hours, each kept for 7 days. Pass `false`
+   * for volumes that hold nothing worth restoring, such as caches.
+   *
+   * When the container is deleted, one final snapshot of each volume is kept.
+   * Kubernetes deployments leave volume backups to the cluster's own tooling.
+   */
+  backups?: false | VolumeBackupOptions
+}
+
+export interface VolumeBackupOptions {
+  /** Hours between snapshots: 1, 2, 4, 6, 8, 12 or 24. Defaults to 24. */
+  intervalHours?: 1 | 2 | 4 | 6 | 8 | 12 | 24
+  /**
+   * Days each snapshot is kept: at most 365. Defaults to 7. A volume holds at
+   * most 450 snapshots, so hourly snapshots can be kept for up to 18 days.
+   */
+  retentionDays?: number
 }
 
 /**
@@ -337,7 +356,7 @@ export class Container extends ResourceBuilder {
    * Configures persistent storage and marks the container stateful.
    * Data survives container restarts.
    * @param size Storage size (e.g., "100Gi", "500Gi", "1Ti").
-   * @param options Optional mount path.
+   * @param options Optional mount path and backup schedule.
    * @returns The Container builder instance.
    */
   public persistentStorage(size: string, options: PersistentStorageOptions = {}): this {
@@ -345,6 +364,16 @@ export class Container extends ResourceBuilder {
       size,
       mountPath: options.mountPath ?? "/data",
     }
+    if (options.backups !== undefined) {
+      persistentStorage.backups =
+        options.backups === false
+          ? { enabled: false, intervalHours: 24, retentionDays: 7 }
+          : {
+              enabled: true,
+              intervalHours: options.backups.intervalHours ?? 24,
+              retentionDays: options.backups.retentionDays ?? 7,
+            }
+    }
 
     this._config.persistentStorage = persistentStorage
     this._config.stateful = true
diff --git a/packages/core/src/generated/index.ts b/packages/core/src/generated/index.ts
index 7f0ff96c7f..13df653ddf 100644
--- a/packages/core/src/generated/index.ts
+++ b/packages/core/src/generated/index.ts
@@ -441,6 +441,11 @@ export type { VaultHeartbeatData } from "./zod/vault-heartbeat-data-schema.js";
 export type { VaultHeartbeatStatus } from "./zod/vault-heartbeat-status-schema.js";
 export type { VaultOutputs } from "./zod/vault-outputs-schema.js";
 export type { Vault } from "./zod/vault-schema.js";
+export type { VolumeBackups } from "./zod/volume-backups-schema.js";
+export type { VolumeBackupsState } from "./zod/volume-backups-state-schema.js";
+export type { VolumeBackupsStatus } from "./zod/volume-backups-status-schema.js";
+export type { VolumeOutput } from "./zod/volume-output-schema.js";
+export type { VolumeRestoreOutput } from "./zod/volume-restore-output-schema.js";
 export type { WorkerCode } from "./zod/worker-code-schema.js";
 export type { WorkerHeartbeatData } from "./zod/worker-heartbeat-data-schema.js";
 export type { WorkerOutputs } from "./zod/worker-outputs-schema.js";
@@ -892,6 +897,11 @@ export { VaultHeartbeatDataSchema } from "./zod/vault-heartbeat-data-schema.js";
 export { VaultHeartbeatStatusSchema } from "./zod/vault-heartbeat-status-schema.js";
 export { VaultOutputsSchema } from "./zod/vault-outputs-schema.js";
 export { VaultSchema } from "./zod/vault-schema.js";
+export { VolumeBackupsSchema } from "./zod/volume-backups-schema.js";
+export { VolumeBackupsStateSchema } from "./zod/volume-backups-state-schema.js";
+export { VolumeBackupsStatusSchema } from "./zod/volume-backups-status-schema.js";
+export { VolumeOutputSchema } from "./zod/volume-output-schema.js";
+export { VolumeRestoreOutputSchema } from "./zod/volume-restore-output-schema.js";
 export { WorkerCodeSchema } from "./zod/worker-code-schema.js";
 export { WorkerHeartbeatDataSchema } from "./zod/worker-heartbeat-data-schema.js";
 export { WorkerOutputsSchema } from "./zod/worker-outputs-schema.js";
diff --git a/packages/core/src/generated/schemas/container.json b/packages/core/src/generated/schemas/container.json
index 7614f71cb5..bce78933bd 100644
--- a/packages/core/src/generated/schemas/container.json
+++ b/packages/core/src/generated/schemas/container.json
@@ -1 +1 @@
-{"type":"object","description":"Container resource for running long-running container workloads.\n\nA Container defines a deployable unit that runs on a ComputeCluster.\nThe managed container backend handles scheduling replicas across machines,\nautoscaling based on various metrics, and service discovery.\n\n## Example\n\n```rust\nuse alien_core::{Container, ContainerCode, ResourceSpec, ContainerAutoscaling, PublicEndpoint, ExposeProtocol};\n\nlet container = Container::new(\"api\".to_string())\n    .cluster(\"compute\".to_string())\n    .code(ContainerCode::Image {\n        image: \"myapp:latest\".to_string(),\n    })\n    .cpu(ResourceSpec { min: \"0.5\".to_string(), desired: \"1\".to_string() })\n    .memory(ResourceSpec { min: \"512Mi\".to_string(), desired: \"1Gi\".to_string() })\n    .port(8080)\n    .public_endpoint(PublicEndpoint {\n        name: \"api\".to_string(),\n        port: 8080,\n        protocol: ExposeProtocol::Http,\n        host_label: None,\n        wildcard_subdomains: false,\n    })\n    .autoscaling(ContainerAutoscaling {\n        min: 2,\n        desired: 3,\n        max: 10,\n        target_cpu_percent: Some(70.0),\n        target_memory_percent: None,\n        target_http_in_flight_per_replica: Some(100),\n        max_http_p95_latency_ms: None,\n    })\n    .permissions(\"container-execution\".to_string())\n    .build();\n```","required":["id","links","ports","code","cpu","memory","permissions"],"properties":{"autoscaling":{"oneOf":[{"type":"null"},{"description":"Autoscaling configuration (only for stateless containers)","type":"object","required":["min","desired","max"],"properties":{"desired":{"type":"integer","format":"int32","description":"Initial desired replicas at container creation","minimum":0},"max":{"type":"integer","format":"int32","description":"Maximum replicas under load","minimum":0},"maxHttpP95LatencyMs":{"type":["number","null"],"format":"double","description":"Maximum acceptable p95 HTTP latency in milliseconds"},"min":{"type":"integer","format":"int32","description":"Minimum replicas (always running)","minimum":0},"targetCpuPercent":{"type":["number","null"],"format":"double","description":"Target CPU utilization percentage for scaling (default: 70%)"},"targetHttpInFlightPerReplica":{"type":["integer","null"],"format":"int32","description":"Target in-flight HTTP requests per replica","minimum":0},"targetMemoryPercent":{"type":["number","null"],"format":"double","description":"Target memory utilization percentage for scaling (default: 80%)"}},"x-readme-ref-name":"ContainerAutoscaling"}]},"cluster":{"type":["string","null"],"description":"ComputeCluster resource ID that this container runs on.\nIf None, will be auto-assigned by ComputeClusterMutation at deployment time."},"code":{"description":"Container code (image or source)","oneOf":[{"type":"object","description":"Container image reference","required":["image","type"],"properties":{"image":{"type":"string","description":"Container image (e.g., `postgres:16`, `ghcr.io/myorg/myimage:latest`)"},"type":{"type":"string","enum":["image"]}}},{"type":"object","description":"Source code to be built","required":["src","toolchain","type"],"properties":{"src":{"type":"string","description":"The source directory to build from"},"toolchain":{"description":"Toolchain configuration with type-safe options","oneOf":[{"type":"object","description":"Rust with Cargo build system","required":["binaryName","type"],"properties":{"binaryName":{"type":"string","description":"Name of the binary to build and run"},"type":{"type":"string","enum":["rust"]}}},{"type":"object","description":"TypeScript/JavaScript compiled to single executable with Bun","required":["type"],"properties":{"binaryName":{"type":["string","null"],"description":"Name of the compiled binary (defaults to package.json name if not specified)"},"type":{"type":"string","enum":["typescript"]}}},{"type":"object","description":"Python application installed from a locked uv project","required":["command","type"],"properties":{"command":{"type":"array","items":{"type":"string"},"description":"Process argv used to start the application"},"package":{"type":["string","null"],"description":"Workspace package to install (omit for a single-package project)"},"pythonVersion":{"type":["string","null"],"description":"Python version used by the runtime image (defaults to 3.12)"},"type":{"type":"string","enum":["python"]}}},{"type":"object","description":"Docker build from Dockerfile","required":["type"],"properties":{"buildArgs":{"type":["object","null"],"description":"Build arguments for docker build","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"dockerfile":{"type":["string","null"],"description":"Dockerfile path relative to src (default: \"Dockerfile\")"},"target":{"type":["string","null"],"description":"Multi-stage build target"},"type":{"type":"string","enum":["docker"]}}}],"x-readme-ref-name":"ToolchainConfig"},"type":{"type":"string","enum":["source"]}}}],"x-readme-ref-name":"ContainerCode"},"command":{"type":["array","null"],"items":{"type":"string"},"description":"Command to override image default"},"commandsEnabled":{"type":"boolean","description":"Whether the container can receive remote commands via the Commands protocol.\nWhen enabled, an app-owned command receiver can lease pending commands\nfor this Container and execute registered handlers.","default":false},"cpu":{"description":"CPU resource requirements","type":"object","required":["min","desired"],"properties":{"desired":{"type":"string","description":"Desired resource allocation (used by scheduler)"},"min":{"type":"string","description":"Minimum resource allocation"}},"x-readme-ref-name":"ResourceSpec"},"environment":{"type":"object","description":"Environment variables","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"ephemeralStorage":{"type":["string","null"],"description":"Ephemeral storage requirement (e.g., \"10Gi\")"},"gpu":{"oneOf":[{"type":"null"},{"description":"GPU requirements (optional)","type":"object","required":["type","count"],"properties":{"count":{"type":"integer","format":"int32","description":"Number of GPUs required (1-8)","minimum":0},"type":{"type":"string","description":"GPU type identifier (e.g., \"nvidia-a100\", \"nvidia-t4\")"}},"x-readme-ref-name":"ContainerGpuSpec"}]},"healthCheck":{"oneOf":[{"type":"null"},{"description":"Health check configuration","type":"object","properties":{"failureThreshold":{"type":"integer","format":"int32","description":"Number of consecutive failures before marking replica unhealthy","minimum":0},"method":{"type":"string","description":"HTTP method to use for health check"},"path":{"type":"string","description":"HTTP endpoint path to check (e.g., \"/health\", \"/ready\")"},"port":{"type":["integer","null"],"format":"int32","description":"Port to check (defaults to container port if not specified)","minimum":0},"timeoutSeconds":{"type":"integer","format":"int32","description":"Request timeout in seconds (1-5)","minimum":0}},"x-readme-ref-name":"HealthCheck"}]},"id":{"type":"string","description":"Unique identifier for the container.\nMust be DNS-compatible: lowercase alphanumeric with hyphens."},"kubernetesLivenessProbe":{"oneOf":[{"type":"null"},{"description":"Kubernetes liveness probe. Restarts an unhealthy container.","type":"object","required":["path","port"],"properties":{"path":{"type":"string","description":"Absolute HTTP path served by the container."},"port":{"type":"integer","format":"int32","description":"Container port to check.","minimum":0}},"x-readme-ref-name":"KubernetesHttpProbe"}]},"kubernetesReadinessProbe":{"oneOf":[{"type":"null"},{"description":"Kubernetes readiness probe. Removes an unready pod from Service endpoints.","type":"object","required":["path","port"],"properties":{"path":{"type":"string","description":"Absolute HTTP path served by the container."},"port":{"type":"integer","format":"int32","description":"Container port to check.","minimum":0}},"x-readme-ref-name":"KubernetesHttpProbe"}]},"kubernetesSecretMounts":{"type":"array","items":{"type":"object","description":"Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.","required":["secretName","mountPath"],"properties":{"mountPath":{"type":"string","description":"Directory where Kubernetes mounts the Secret's keys as read-only files."},"secretName":{"type":"string","description":"Name of the existing Secret in the deployment namespace."}},"x-readme-ref-name":"KubernetesSecretMount"},"description":"Existing Kubernetes Secrets mounted as read-only directories."},"links":{"type":"array","items":{"type":"object","description":"Reference to a resource by its stable id and resource type.","required":["type","id"],"properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"x-readme-ref-name":"ResourceRef"},"description":"Resource links (dependencies)"},"memory":{"description":"Memory resource requirements (must use Ki/Mi/Gi/Ti suffix)","type":"object","required":["min","desired"],"properties":{"desired":{"type":"string","description":"Desired resource allocation (used by scheduler)"},"min":{"type":"string","description":"Minimum resource allocation"}},"x-readme-ref-name":"ResourceSpec"},"permissions":{"type":"string","description":"Permission profile name"},"persistentStorage":{"oneOf":[{"type":"null"},{"description":"Persistent storage configuration (only for stateful containers)","type":"object","required":["size","mountPath"],"properties":{"mountPath":{"type":"string","description":"Mount path inside the container"},"size":{"type":"string","description":"Storage size (e.g., \"100Gi\", \"500Gi\")"}},"x-readme-ref-name":"PersistentStorage"}]},"pool":{"type":["string","null"],"description":"Capacity group to run on (must exist in the cluster)\nIf not specified, containers are scheduled to any available group."},"ports":{"type":"array","items":{"type":"object","description":"Container port configuration.","required":["port"],"properties":{"port":{"type":"integer","format":"int32","description":"Port number","minimum":0}},"x-readme-ref-name":"ContainerPort"},"description":"Internal container ports (at least one required)."},"publicEndpoints":{"type":"array","items":{"type":"object","description":"Public endpoint configuration for port-backed workload resources.","required":["name","port","protocol"],"properties":{"hostLabel":{"type":["string","null"],"description":"Optional DNS label override for generated endpoint hostnames."},"name":{"type":"string","description":"Endpoint name within the resource."},"port":{"type":"integer","format":"int32","description":"Workload port served by the public endpoint.","minimum":0},"protocol":{"description":"Public protocol.","type":"string","enum":["http","tcp"],"x-readme-ref-name":"ExposeProtocol"},"wildcardSubdomains":{"type":"boolean","description":"Whether to route wildcard subdomains to this endpoint."}},"x-readme-ref-name":"PublicEndpoint"},"description":"Public endpoints exposed by the container."},"replicas":{"type":["integer","null"],"format":"int32","description":"Fixed replica count (for stateful containers or stateless without autoscaling)","minimum":0},"security":{"oneOf":[{"type":"null"},{"description":"Security settings shared by supported container runtimes.","type":"object","required":["profile","runAsUser","runAsGroup","readOnlyRootFilesystem"],"properties":{"profile":{"description":"Runtime security profile.","type":"string","enum":["restricted"],"x-readme-ref-name":"ContainerSecurityProfile"},"readOnlyRootFilesystem":{"type":"boolean","description":"Mount the root filesystem read-only."},"runAsGroup":{"type":"integer","format":"int64","description":"Numeric GID for the container process."},"runAsUser":{"type":"integer","format":"int64","description":"Numeric UID for the container process."}},"x-readme-ref-name":"ContainerSecurity"}]},"stateful":{"type":"boolean","description":"Whether container is stateful (gets stable ordinals, optional persistent volumes)"},"stopGracePeriodSeconds":{"type":["integer","null"],"format":"int32","description":"Grace period in seconds for stopping replicas during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.","maximum":86400,"minimum":1},"tunnel":{"oneOf":[{"type":"null"},{"description":"Makes one HTTP port reachable from the control plane through the\nmanager's tunnel, over the operator's outbound connection. Nothing is\nexposed on the deployment's network.","type":"object","required":["port"],"properties":{"port":{"type":"integer","format":"int32","description":"Container port that serves HTTP. Must be one of the container's ports.","minimum":0}},"additionalProperties":false,"x-readme-ref-name":"ContainerTunnel"}]}},"additionalProperties":false,"x-readme-ref-name":"Container"}
\ No newline at end of file
+{"type":"object","description":"Container resource for running long-running container workloads.\n\nA Container defines a deployable unit that runs on a ComputeCluster.\nThe managed container backend handles scheduling replicas across machines,\nautoscaling based on various metrics, and service discovery.\n\n## Example\n\n```rust\nuse alien_core::{Container, ContainerCode, ResourceSpec, ContainerAutoscaling, PublicEndpoint, ExposeProtocol};\n\nlet container = Container::new(\"api\".to_string())\n    .cluster(\"compute\".to_string())\n    .code(ContainerCode::Image {\n        image: \"myapp:latest\".to_string(),\n    })\n    .cpu(ResourceSpec { min: \"0.5\".to_string(), desired: \"1\".to_string() })\n    .memory(ResourceSpec { min: \"512Mi\".to_string(), desired: \"1Gi\".to_string() })\n    .port(8080)\n    .public_endpoint(PublicEndpoint {\n        name: \"api\".to_string(),\n        port: 8080,\n        protocol: ExposeProtocol::Http,\n        host_label: None,\n        wildcard_subdomains: false,\n    })\n    .autoscaling(ContainerAutoscaling {\n        min: 2,\n        desired: 3,\n        max: 10,\n        target_cpu_percent: Some(70.0),\n        target_memory_percent: None,\n        target_http_in_flight_per_replica: Some(100),\n        max_http_p95_latency_ms: None,\n    })\n    .permissions(\"container-execution\".to_string())\n    .build();\n```","required":["id","links","ports","code","cpu","memory","permissions"],"properties":{"autoscaling":{"oneOf":[{"type":"null"},{"description":"Autoscaling configuration (only for stateless containers)","type":"object","required":["min","desired","max"],"properties":{"desired":{"type":"integer","format":"int32","description":"Initial desired replicas at container creation","minimum":0},"max":{"type":"integer","format":"int32","description":"Maximum replicas under load","minimum":0},"maxHttpP95LatencyMs":{"type":["number","null"],"format":"double","description":"Maximum acceptable p95 HTTP latency in milliseconds"},"min":{"type":"integer","format":"int32","description":"Minimum replicas (always running)","minimum":0},"targetCpuPercent":{"type":["number","null"],"format":"double","description":"Target CPU utilization percentage for scaling (default: 70%)"},"targetHttpInFlightPerReplica":{"type":["integer","null"],"format":"int32","description":"Target in-flight HTTP requests per replica","minimum":0},"targetMemoryPercent":{"type":["number","null"],"format":"double","description":"Target memory utilization percentage for scaling (default: 80%)"}},"x-readme-ref-name":"ContainerAutoscaling"}]},"cluster":{"type":["string","null"],"description":"ComputeCluster resource ID that this container runs on.\nIf None, will be auto-assigned by ComputeClusterMutation at deployment time."},"code":{"description":"Container code (image or source)","oneOf":[{"type":"object","description":"Container image reference","required":["image","type"],"properties":{"image":{"type":"string","description":"Container image (e.g., `postgres:16`, `ghcr.io/myorg/myimage:latest`)"},"type":{"type":"string","enum":["image"]}}},{"type":"object","description":"Source code to be built","required":["src","toolchain","type"],"properties":{"src":{"type":"string","description":"The source directory to build from"},"toolchain":{"description":"Toolchain configuration with type-safe options","oneOf":[{"type":"object","description":"Rust with Cargo build system","required":["binaryName","type"],"properties":{"binaryName":{"type":"string","description":"Name of the binary to build and run"},"type":{"type":"string","enum":["rust"]}}},{"type":"object","description":"TypeScript/JavaScript compiled to single executable with Bun","required":["type"],"properties":{"binaryName":{"type":["string","null"],"description":"Name of the compiled binary (defaults to package.json name if not specified)"},"type":{"type":"string","enum":["typescript"]}}},{"type":"object","description":"Python application installed from a locked uv project","required":["command","type"],"properties":{"command":{"type":"array","items":{"type":"string"},"description":"Process argv used to start the application"},"package":{"type":["string","null"],"description":"Workspace package to install (omit for a single-package project)"},"pythonVersion":{"type":["string","null"],"description":"Python version used by the runtime image (defaults to 3.12)"},"type":{"type":"string","enum":["python"]}}},{"type":"object","description":"Docker build from Dockerfile","required":["type"],"properties":{"buildArgs":{"type":["object","null"],"description":"Build arguments for docker build","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"dockerfile":{"type":["string","null"],"description":"Dockerfile path relative to src (default: \"Dockerfile\")"},"target":{"type":["string","null"],"description":"Multi-stage build target"},"type":{"type":"string","enum":["docker"]}}}],"x-readme-ref-name":"ToolchainConfig"},"type":{"type":"string","enum":["source"]}}}],"x-readme-ref-name":"ContainerCode"},"command":{"type":["array","null"],"items":{"type":"string"},"description":"Command to override image default"},"commandsEnabled":{"type":"boolean","description":"Whether the container can receive remote commands via the Commands protocol.\nWhen enabled, an app-owned command receiver can lease pending commands\nfor this Container and execute registered handlers.","default":false},"cpu":{"description":"CPU resource requirements","type":"object","required":["min","desired"],"properties":{"desired":{"type":"string","description":"Desired resource allocation (used by scheduler)"},"min":{"type":"string","description":"Minimum resource allocation"}},"x-readme-ref-name":"ResourceSpec"},"environment":{"type":"object","description":"Environment variables","additionalProperties":{"type":"string"},"propertyNames":{"type":"string"}},"ephemeralStorage":{"type":["string","null"],"description":"Ephemeral storage requirement (e.g., \"10Gi\")"},"gpu":{"oneOf":[{"type":"null"},{"description":"GPU requirements (optional)","type":"object","required":["type","count"],"properties":{"count":{"type":"integer","format":"int32","description":"Number of GPUs required (1-8)","minimum":0},"type":{"type":"string","description":"GPU type identifier (e.g., \"nvidia-a100\", \"nvidia-t4\")"}},"x-readme-ref-name":"ContainerGpuSpec"}]},"healthCheck":{"oneOf":[{"type":"null"},{"description":"Health check configuration","type":"object","properties":{"failureThreshold":{"type":"integer","format":"int32","description":"Number of consecutive failures before marking replica unhealthy","minimum":0},"method":{"type":"string","description":"HTTP method to use for health check"},"path":{"type":"string","description":"HTTP endpoint path to check (e.g., \"/health\", \"/ready\")"},"port":{"type":["integer","null"],"format":"int32","description":"Port to check (defaults to container port if not specified)","minimum":0},"timeoutSeconds":{"type":"integer","format":"int32","description":"Request timeout in seconds (1-5)","minimum":0}},"x-readme-ref-name":"HealthCheck"}]},"id":{"type":"string","description":"Unique identifier for the container.\nMust be DNS-compatible: lowercase alphanumeric with hyphens."},"kubernetesLivenessProbe":{"oneOf":[{"type":"null"},{"description":"Kubernetes liveness probe. Restarts an unhealthy container.","type":"object","required":["path","port"],"properties":{"path":{"type":"string","description":"Absolute HTTP path served by the container."},"port":{"type":"integer","format":"int32","description":"Container port to check.","minimum":0}},"x-readme-ref-name":"KubernetesHttpProbe"}]},"kubernetesReadinessProbe":{"oneOf":[{"type":"null"},{"description":"Kubernetes readiness probe. Removes an unready pod from Service endpoints.","type":"object","required":["path","port"],"properties":{"path":{"type":"string","description":"Absolute HTTP path served by the container."},"port":{"type":"integer","format":"int32","description":"Container port to check.","minimum":0}},"x-readme-ref-name":"KubernetesHttpProbe"}]},"kubernetesSecretMounts":{"type":"array","items":{"type":"object","description":"Mounts an existing, setup-owned Kubernetes Secret into a Container pod.\nThe Secret must exist in the deployment namespace before the workload starts.","required":["secretName","mountPath"],"properties":{"mountPath":{"type":"string","description":"Directory where Kubernetes mounts the Secret's keys as read-only files."},"secretName":{"type":"string","description":"Name of the existing Secret in the deployment namespace."}},"x-readme-ref-name":"KubernetesSecretMount"},"description":"Existing Kubernetes Secrets mounted as read-only directories."},"links":{"type":"array","items":{"type":"object","description":"Reference to a resource by its stable id and resource type.","required":["type","id"],"properties":{"id":{"type":"string"},"type":{"type":"string","description":"Resource type identifier that determines the specific kind of resource. This field is used for polymorphic deserialization and resource-specific behavior.","examples":["worker","storage","queue","redis","postgres"],"x-readme-ref-name":"ResourceType"}},"x-readme-ref-name":"ResourceRef"},"description":"Resource links (dependencies)"},"memory":{"description":"Memory resource requirements (must use Ki/Mi/Gi/Ti suffix)","type":"object","required":["min","desired"],"properties":{"desired":{"type":"string","description":"Desired resource allocation (used by scheduler)"},"min":{"type":"string","description":"Minimum resource allocation"}},"x-readme-ref-name":"ResourceSpec"},"permissions":{"type":"string","description":"Permission profile name"},"persistentStorage":{"oneOf":[{"type":"null"},{"description":"Persistent storage configuration (only for stateful containers)","type":"object","required":["size","mountPath"],"properties":{"backups":{"description":"Scheduled snapshots of each replica's volume. On by default.","type":"object","properties":{"enabled":{"type":"boolean","description":"Whether snapshots are taken. Defaults to true."},"intervalHours":{"type":"integer","format":"int32","description":"Hours between snapshots: 1, 2, 4, 6, 8, 12 or 24. Defaults to 24.","minimum":0},"retentionDays":{"type":"integer","format":"int32","description":"Days each snapshot is kept, at most 365. Defaults to 7.","minimum":0}},"x-readme-ref-name":"VolumeBackups"},"mountPath":{"type":"string","description":"Mount path inside the container"},"size":{"type":"string","description":"Storage size (e.g., \"100Gi\", \"500Gi\")"}},"x-readme-ref-name":"PersistentStorage"}]},"pool":{"type":["string","null"],"description":"Capacity group to run on (must exist in the cluster)\nIf not specified, containers are scheduled to any available group."},"ports":{"type":"array","items":{"type":"object","description":"Container port configuration.","required":["port"],"properties":{"port":{"type":"integer","format":"int32","description":"Port number","minimum":0}},"x-readme-ref-name":"ContainerPort"},"description":"Internal container ports (at least one required)."},"publicEndpoints":{"type":"array","items":{"type":"object","description":"Public endpoint configuration for port-backed workload resources.","required":["name","port","protocol"],"properties":{"hostLabel":{"type":["string","null"],"description":"Optional DNS label override for generated endpoint hostnames."},"name":{"type":"string","description":"Endpoint name within the resource."},"port":{"type":"integer","format":"int32","description":"Workload port served by the public endpoint.","minimum":0},"protocol":{"description":"Public protocol.","type":"string","enum":["http","tcp"],"x-readme-ref-name":"ExposeProtocol"},"wildcardSubdomains":{"type":"boolean","description":"Whether to route wildcard subdomains to this endpoint."}},"x-readme-ref-name":"PublicEndpoint"},"description":"Public endpoints exposed by the container."},"replicas":{"type":["integer","null"],"format":"int32","description":"Fixed replica count (for stateful containers or stateless without autoscaling)","minimum":0},"security":{"oneOf":[{"type":"null"},{"description":"Security settings shared by supported container runtimes.","type":"object","required":["profile","runAsUser","runAsGroup","readOnlyRootFilesystem"],"properties":{"profile":{"description":"Runtime security profile.","type":"string","enum":["restricted"],"x-readme-ref-name":"ContainerSecurityProfile"},"readOnlyRootFilesystem":{"type":"boolean","description":"Mount the root filesystem read-only."},"runAsGroup":{"type":"integer","format":"int64","description":"Numeric GID for the container process."},"runAsUser":{"type":"integer","format":"int64","description":"Numeric UID for the container process."}},"x-readme-ref-name":"ContainerSecurity"}]},"stateful":{"type":"boolean","description":"Whether container is stateful (gets stable ordinals, optional persistent volumes)"},"stopGracePeriodSeconds":{"type":["integer","null"],"format":"int32","description":"Grace period in seconds for stopping replicas during updates, drains, and deletes.\n\nWhen omitted, the runtime backend applies its default. Valid values are\n1 second through 24 hours.","maximum":86400,"minimum":1},"tunnel":{"oneOf":[{"type":"null"},{"description":"Makes one HTTP port reachable from the control plane through the\nmanager's tunnel, over the operator's outbound connection. Nothing is\nexposed on the deployment's network.","type":"object","required":["port"],"properties":{"port":{"type":"integer","format":"int32","description":"Container port that serves HTTP. Must be one of the container's ports.","minimum":0}},"additionalProperties":false,"x-readme-ref-name":"ContainerTunnel"}]}},"additionalProperties":false,"x-readme-ref-name":"Container"}
\ No newline at end of file
diff --git a/packages/core/src/generated/schemas/containerOutputs.json b/packages/core/src/generated/schemas/containerOutputs.json
index 3d58a9ce6e..6a507d870a 100644
--- a/packages/core/src/generated/schemas/containerOutputs.json
+++ b/packages/core/src/generated/schemas/containerOutputs.json
@@ -1 +1 @@
-{"type":"object","description":"Outputs generated by a successfully provisioned Container.","required":["name","status","currentReplicas","desiredReplicas","internalDns","replicas"],"properties":{"currentReplicas":{"type":"integer","format":"int32","description":"Number of current replicas","minimum":0},"desiredReplicas":{"type":"integer","format":"int32","description":"Desired number of replicas","minimum":0},"internalDns":{"type":"string","description":"Internal DNS name (e.g., \"api.svc\")"},"name":{"type":"string","description":"Container name in the managed container backend"},"publicEndpoints":{"type":"object","description":"Public endpoints resolved for this container.","additionalProperties":{"type":"object","description":"Runtime-resolved public endpoint metadata.","required":["url","host","protocol","port"],"properties":{"host":{"type":"string","description":"Hostname for this endpoint."},"loadBalancerEndpoint":{"oneOf":[{"type":"null"},{"description":"Load balancer endpoint information for DNS management.","type":"object","required":["dnsName"],"properties":{"dnsName":{"type":"string","description":"The DNS name of the load balancer endpoint (e.g., ALB DNS, API Gateway domain)."},"hostedZoneId":{"type":["string","null"],"description":"AWS Route53 hosted zone ID (for ALIAS records). Only set on AWS."}},"x-readme-ref-name":"LoadBalancerEndpoint"}]},"port":{"type":"integer","format":"int32","description":"Public connection port.","maximum":65535,"minimum":1},"protocol":{"description":"Public connection protocol.","type":"string","enum":["http","tcp"],"x-readme-ref-name":"ExposeProtocol"},"url":{"type":"string","description":"Base URL for this endpoint."},"wildcardHost":{"type":["string","null"],"description":"Wildcard hostname routed to this endpoint, when configured."}},"x-readme-ref-name":"PublicEndpointOutput"},"propertyNames":{"type":"string"}},"replicas":{"type":"array","items":{"type":"object","description":"Status of a single container replica.","required":["replicaId","healthy"],"properties":{"containerIp":{"type":["string","null"],"description":"Container IP address (for service discovery)"},"healthy":{"type":"boolean","description":"Whether the replica is healthy"},"machineId":{"type":["string","null"],"description":"Machine ID the replica is running on"},"ordinal":{"type":["integer","null"],"format":"int32","description":"Ordinal (for stateful containers)","minimum":0},"replicaId":{"type":"string","description":"Replica ID (e.g., \"api-0\", \"api-1\")"}},"x-readme-ref-name":"ReplicaStatus"},"description":"Status of each replica"},"status":{"description":"Current container status","type":"string","enum":["pending","running","stopped","failing"],"x-readme-ref-name":"ContainerStatus"}},"x-readme-ref-name":"ContainerOutputs"}
\ No newline at end of file
+{"type":"object","description":"Outputs generated by a successfully provisioned Container.","required":["name","status","currentReplicas","desiredReplicas","internalDns","replicas"],"properties":{"currentReplicas":{"type":"integer","format":"int32","description":"Number of current replicas","minimum":0},"desiredReplicas":{"type":"integer","format":"int32","description":"Desired number of replicas","minimum":0},"internalDns":{"type":"string","description":"Internal DNS name (e.g., \"api.svc\")"},"name":{"type":"string","description":"Container name in the managed container backend"},"publicEndpoints":{"type":"object","description":"Public endpoints resolved for this container.","additionalProperties":{"type":"object","description":"Runtime-resolved public endpoint metadata.","required":["url","host","protocol","port"],"properties":{"host":{"type":"string","description":"Hostname for this endpoint."},"loadBalancerEndpoint":{"oneOf":[{"type":"null"},{"description":"Load balancer endpoint information for DNS management.","type":"object","required":["dnsName"],"properties":{"dnsName":{"type":"string","description":"The DNS name of the load balancer endpoint (e.g., ALB DNS, API Gateway domain)."},"hostedZoneId":{"type":["string","null"],"description":"AWS Route53 hosted zone ID (for ALIAS records). Only set on AWS."}},"x-readme-ref-name":"LoadBalancerEndpoint"}]},"port":{"type":"integer","format":"int32","description":"Public connection port.","maximum":65535,"minimum":1},"protocol":{"description":"Public connection protocol.","type":"string","enum":["http","tcp"],"x-readme-ref-name":"ExposeProtocol"},"url":{"type":"string","description":"Base URL for this endpoint."},"wildcardHost":{"type":["string","null"],"description":"Wildcard hostname routed to this endpoint, when configured."}},"x-readme-ref-name":"PublicEndpointOutput"},"propertyNames":{"type":"string"}},"replicas":{"type":"array","items":{"type":"object","description":"Status of a single container replica.","required":["replicaId","healthy"],"properties":{"containerIp":{"type":["string","null"],"description":"Container IP address (for service discovery)"},"healthy":{"type":"boolean","description":"Whether the replica is healthy"},"machineId":{"type":["string","null"],"description":"Machine ID the replica is running on"},"ordinal":{"type":["integer","null"],"format":"int32","description":"Ordinal (for stateful containers)","minimum":0},"replicaId":{"type":"string","description":"Replica ID (e.g., \"api-0\", \"api-1\")"}},"x-readme-ref-name":"ReplicaStatus"},"description":"Status of each replica"},"status":{"description":"Current container status","type":"string","enum":["pending","running","stopped","failing"],"x-readme-ref-name":"ContainerStatus"},"volumeBackups":{"oneOf":[{"type":"null"},{"description":"Whether the persistent volumes' snapshot schedule is in place.","type":"object","required":["state"],"properties":{"message":{"type":["string","null"],"description":"What is missing when the state is `setupRequired`"},"state":{"description":"Current state of the schedule","type":"string","enum":["active","disabled","setupRequired"],"x-readme-ref-name":"VolumeBackupsState"}},"x-readme-ref-name":"VolumeBackupsStatus"}]},"volumes":{"type":"array","items":{"type":"object","description":"A replica's persistent volume and its latest completed snapshot.","required":["ordinal","volumeId","zone"],"properties":{"lastRestore":{"oneOf":[{"type":"null"},{"description":"The latest volume restore performed on this ordinal, if any","type":"object","required":["requestId","snapshotId","replacedVolumeSnapshotId","completedAt"],"properties":{"completedAt":{"type":"string","description":"When the restored volume was put in place (RFC 3339)"},"replacedVolumeSnapshotId":{"type":"string","description":"Snapshot of the replaced volume, taken just before it was deleted"},"requestId":{"type":"string","description":"ID of the restore request"},"snapshotId":{"type":"string","description":"Snapshot the volume was restored from"}},"x-readme-ref-name":"VolumeRestoreOutput"}]},"lastSnapshotAt":{"type":["string","null"],"description":"When the latest completed snapshot was started (RFC 3339)"},"lastSnapshotId":{"type":["string","null"],"description":"Cloud ID of the latest completed snapshot, if any"},"ordinal":{"type":"integer","format":"int32","description":"Replica ordinal the volume belongs to","minimum":0},"volumeId":{"type":"string","description":"Cloud ID of the volume (EBS volume ID, Persistent Disk name, or Managed Disk ID)"},"zone":{"type":"string","description":"Zone the volume lives in"}},"x-readme-ref-name":"VolumeOutput"},"description":"Persistent volumes, one per replica ordinal, with their latest snapshot."}},"x-readme-ref-name":"ContainerOutputs"}
\ No newline at end of file
diff --git a/packages/core/src/generated/schemas/persistentStorage.json b/packages/core/src/generated/schemas/persistentStorage.json
index 484b8f3ca8..20259938b4 100644
--- a/packages/core/src/generated/schemas/persistentStorage.json
+++ b/packages/core/src/generated/schemas/persistentStorage.json
@@ -1 +1 @@
-{"type":"object","description":"Persistent storage configuration for stateful containers.","required":["size","mountPath"],"properties":{"mountPath":{"type":"string","description":"Mount path inside the container"},"size":{"type":"string","description":"Storage size (e.g., \"100Gi\", \"500Gi\")"}},"x-readme-ref-name":"PersistentStorage"}
\ No newline at end of file
+{"type":"object","description":"Persistent storage configuration for stateful containers.","required":["size","mountPath"],"properties":{"backups":{"description":"Scheduled snapshots of each replica's volume. On by default.","type":"object","properties":{"enabled":{"type":"boolean","description":"Whether snapshots are taken. Defaults to true."},"intervalHours":{"type":"integer","format":"int32","description":"Hours between snapshots: 1, 2, 4, 6, 8, 12 or 24. Defaults to 24.","minimum":0},"retentionDays":{"type":"integer","format":"int32","description":"Days each snapshot is kept, at most 365. Defaults to 7.","minimum":0}},"x-readme-ref-name":"VolumeBackups"},"mountPath":{"type":"string","description":"Mount path inside the container"},"size":{"type":"string","description":"Storage size (e.g., \"100Gi\", \"500Gi\")"}},"x-readme-ref-name":"PersistentStorage"}
\ No newline at end of file
diff --git a/packages/core/src/generated/schemas/volumeBackups.json b/packages/core/src/generated/schemas/volumeBackups.json
new file mode 100644
index 0000000000..7ede0c3422
--- /dev/null
+++ b/packages/core/src/generated/schemas/volumeBackups.json
@@ -0,0 +1 @@
+{"type":"object","description":"Scheduled snapshots of a persistent volume.\n\nThe cloud's own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster's own tooling,\nand local deployments don't snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.","properties":{"enabled":{"type":"boolean","description":"Whether snapshots are taken. Defaults to true."},"intervalHours":{"type":"integer","format":"int32","description":"Hours between snapshots: 1, 2, 4, 6, 8, 12 or 24. Defaults to 24.","minimum":0},"retentionDays":{"type":"integer","format":"int32","description":"Days each snapshot is kept, at most 365. Defaults to 7.","minimum":0}},"x-readme-ref-name":"VolumeBackups"}
\ No newline at end of file
diff --git a/packages/core/src/generated/schemas/volumeBackupsState.json b/packages/core/src/generated/schemas/volumeBackupsState.json
new file mode 100644
index 0000000000..c287c9c8fc
--- /dev/null
+++ b/packages/core/src/generated/schemas/volumeBackupsState.json
@@ -0,0 +1 @@
+{"type":"string","description":"State of a container's snapshot schedule.","enum":["active","disabled","setupRequired"],"x-readme-ref-name":"VolumeBackupsState"}
\ No newline at end of file
diff --git a/packages/core/src/generated/schemas/volumeBackupsStatus.json b/packages/core/src/generated/schemas/volumeBackupsStatus.json
new file mode 100644
index 0000000000..a9d453c299
--- /dev/null
+++ b/packages/core/src/generated/schemas/volumeBackupsStatus.json
@@ -0,0 +1 @@
+{"type":"object","description":"Whether a container's snapshot schedule is in place.","required":["state"],"properties":{"message":{"type":["string","null"],"description":"What is missing when the state is `setupRequired`"},"state":{"description":"Current state of the schedule","type":"string","enum":["active","disabled","setupRequired"],"x-readme-ref-name":"VolumeBackupsState"}},"x-readme-ref-name":"VolumeBackupsStatus"}
\ No newline at end of file
diff --git a/packages/core/src/generated/schemas/volumeOutput.json b/packages/core/src/generated/schemas/volumeOutput.json
new file mode 100644
index 0000000000..d04f5b9ca5
--- /dev/null
+++ b/packages/core/src/generated/schemas/volumeOutput.json
@@ -0,0 +1 @@
+{"type":"object","description":"A replica's persistent volume and its latest completed snapshot.","required":["ordinal","volumeId","zone"],"properties":{"lastRestore":{"oneOf":[{"type":"null"},{"description":"The latest volume restore performed on this ordinal, if any","type":"object","required":["requestId","snapshotId","replacedVolumeSnapshotId","completedAt"],"properties":{"completedAt":{"type":"string","description":"When the restored volume was put in place (RFC 3339)"},"replacedVolumeSnapshotId":{"type":"string","description":"Snapshot of the replaced volume, taken just before it was deleted"},"requestId":{"type":"string","description":"ID of the restore request"},"snapshotId":{"type":"string","description":"Snapshot the volume was restored from"}},"x-readme-ref-name":"VolumeRestoreOutput"}]},"lastSnapshotAt":{"type":["string","null"],"description":"When the latest completed snapshot was started (RFC 3339)"},"lastSnapshotId":{"type":["string","null"],"description":"Cloud ID of the latest completed snapshot, if any"},"ordinal":{"type":"integer","format":"int32","description":"Replica ordinal the volume belongs to","minimum":0},"volumeId":{"type":"string","description":"Cloud ID of the volume (EBS volume ID, Persistent Disk name, or Managed Disk ID)"},"zone":{"type":"string","description":"Zone the volume lives in"}},"x-readme-ref-name":"VolumeOutput"}
\ No newline at end of file
diff --git a/packages/core/src/generated/schemas/volumeRestoreOutput.json b/packages/core/src/generated/schemas/volumeRestoreOutput.json
new file mode 100644
index 0000000000..88bb5c6434
--- /dev/null
+++ b/packages/core/src/generated/schemas/volumeRestoreOutput.json
@@ -0,0 +1 @@
+{"type":"object","description":"A completed volume restore.","required":["requestId","snapshotId","replacedVolumeSnapshotId","completedAt"],"properties":{"completedAt":{"type":"string","description":"When the restored volume was put in place (RFC 3339)"},"replacedVolumeSnapshotId":{"type":"string","description":"Snapshot of the replaced volume, taken just before it was deleted"},"requestId":{"type":"string","description":"ID of the restore request"},"snapshotId":{"type":"string","description":"Snapshot the volume was restored from"}},"x-readme-ref-name":"VolumeRestoreOutput"}
\ No newline at end of file
diff --git a/packages/core/src/generated/zod/container-outputs-schema.ts b/packages/core/src/generated/zod/container-outputs-schema.ts
index 33027b859e..0db01f1e3b 100644
--- a/packages/core/src/generated/zod/container-outputs-schema.ts
+++ b/packages/core/src/generated/zod/container-outputs-schema.ts
@@ -7,6 +7,8 @@ import * as z from "zod";
 import { ContainerStatusSchema } from "./container-status-schema.js";
 import { PublicEndpointOutputSchema } from "./public-endpoint-output-schema.js";
 import { ReplicaStatusSchema } from "./replica-status-schema.js";
+import { VolumeBackupsStatusSchema } from "./volume-backups-status-schema.js";
+import { VolumeOutputSchema } from "./volume-output-schema.js";
 
 /**
  * @description Outputs generated by a successfully provisioned Container.
@@ -24,6 +26,12 @@ get "replicas"(){
               },
 get "status"(){
                 return ContainerStatusSchema.describe("Container status in the managed container backend.")
+              },
+get "volumeBackups"(){
+                return z.union([VolumeBackupsStatusSchema, z.null()]).optional()
+              },
+get "volumes"(){
+                return z.array(VolumeOutputSchema.describe("A replica's persistent volume and its latest completed snapshot.")).describe("Persistent volumes, one per replica ordinal, with their latest snapshot.").optional()
               }
     }).describe("Outputs generated by a successfully provisioned Container.")
 
diff --git a/packages/core/src/generated/zod/index.ts b/packages/core/src/generated/zod/index.ts
index 8842a3336e..60e7104f5a 100644
--- a/packages/core/src/generated/zod/index.ts
+++ b/packages/core/src/generated/zod/index.ts
@@ -441,6 +441,11 @@ export type { VaultHeartbeatData } from "./vault-heartbeat-data-schema.js";
 export type { VaultHeartbeatStatus } from "./vault-heartbeat-status-schema.js";
 export type { VaultOutputs } from "./vault-outputs-schema.js";
 export type { Vault } from "./vault-schema.js";
+export type { VolumeBackups } from "./volume-backups-schema.js";
+export type { VolumeBackupsState } from "./volume-backups-state-schema.js";
+export type { VolumeBackupsStatus } from "./volume-backups-status-schema.js";
+export type { VolumeOutput } from "./volume-output-schema.js";
+export type { VolumeRestoreOutput } from "./volume-restore-output-schema.js";
 export type { WorkerCode } from "./worker-code-schema.js";
 export type { WorkerHeartbeatData } from "./worker-heartbeat-data-schema.js";
 export type { WorkerOutputs } from "./worker-outputs-schema.js";
@@ -892,6 +897,11 @@ export { VaultHeartbeatDataSchema } from "./vault-heartbeat-data-schema.js";
 export { VaultHeartbeatStatusSchema } from "./vault-heartbeat-status-schema.js";
 export { VaultOutputsSchema } from "./vault-outputs-schema.js";
 export { VaultSchema } from "./vault-schema.js";
+export { VolumeBackupsSchema } from "./volume-backups-schema.js";
+export { VolumeBackupsStateSchema } from "./volume-backups-state-schema.js";
+export { VolumeBackupsStatusSchema } from "./volume-backups-status-schema.js";
+export { VolumeOutputSchema } from "./volume-output-schema.js";
+export { VolumeRestoreOutputSchema } from "./volume-restore-output-schema.js";
 export { WorkerCodeSchema } from "./worker-code-schema.js";
 export { WorkerHeartbeatDataSchema } from "./worker-heartbeat-data-schema.js";
 export { WorkerOutputsSchema } from "./worker-outputs-schema.js";
diff --git a/packages/core/src/generated/zod/persistent-storage-schema.ts b/packages/core/src/generated/zod/persistent-storage-schema.ts
index 673919422a..ca27aafabb 100644
--- a/packages/core/src/generated/zod/persistent-storage-schema.ts
+++ b/packages/core/src/generated/zod/persistent-storage-schema.ts
@@ -4,12 +4,16 @@
 */
 
 import * as z from "zod";
+import { VolumeBackupsSchema } from "./volume-backups-schema.js";
 
 /**
  * @description Persistent storage configuration for stateful containers.
  */
 export const PersistentStorageSchema = z.object({
-    "mountPath": z.string().describe("Mount path inside the container"),
+    get "backups"(){
+                return VolumeBackupsSchema.describe("Scheduled snapshots of a persistent volume.\n\nThe cloud's own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster's own tooling,\nand local deployments don't snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.").optional()
+              },
+"mountPath": z.string().describe("Mount path inside the container"),
 "size": z.string().describe("Storage size (e.g., \"100Gi\", \"500Gi\")")
     }).describe("Persistent storage configuration for stateful containers.")
 
diff --git a/packages/core/src/generated/zod/volume-backups-schema.ts b/packages/core/src/generated/zod/volume-backups-schema.ts
new file mode 100644
index 0000000000..f9c26841f0
--- /dev/null
+++ b/packages/core/src/generated/zod/volume-backups-schema.ts
@@ -0,0 +1,17 @@
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+import * as z from "zod";
+
+/**
+ * @description Scheduled snapshots of a persistent volume.\n\nThe cloud\'s own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster\'s own tooling,\nand local deployments don\'t snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.
+ */
+export const VolumeBackupsSchema = z.object({
+    "enabled": z.optional(z.boolean().describe("Whether snapshots are taken. Defaults to true.")),
+"intervalHours": z.optional(z.int().min(0).describe("Hours between snapshots: 1, 2, 4, 6, 8, 12 or 24. Defaults to 24.")),
+"retentionDays": z.optional(z.int().min(0).describe("Days each snapshot is kept, at most 365. Defaults to 7."))
+    }).describe("Scheduled snapshots of a persistent volume.\n\nThe cloud's own scheduler takes the snapshots (AWS Data Lifecycle Manager,\na Compute Engine snapshot schedule, or Azure Disk Backup), so they keep being\ntaken while the deployment is unreachable. Snapshots are crash-consistent:\nthe volume as it would be after a sudden power loss. When a container is\ndeleted, Alien keeps one final snapshot of each volume.\n\nKubernetes deployments leave volume backups to the cluster's own tooling,\nand local deployments don't snapshot volumes. Neither reports volumes in\n`ContainerOutputs.volumes` or a `volumeBackups` status.")
+
+export type VolumeBackups = z.infer<typeof VolumeBackupsSchema>
\ No newline at end of file
diff --git a/packages/core/src/generated/zod/volume-backups-state-schema.ts b/packages/core/src/generated/zod/volume-backups-state-schema.ts
new file mode 100644
index 0000000000..bac1bb40c0
--- /dev/null
+++ b/packages/core/src/generated/zod/volume-backups-state-schema.ts
@@ -0,0 +1,13 @@
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+import * as z from "zod";
+
+/**
+ * @description State of a container\'s snapshot schedule.
+ */
+export const VolumeBackupsStateSchema = z.enum(["active", "disabled", "setupRequired"]).describe("State of a container's snapshot schedule.")
+
+export type VolumeBackupsState = z.infer<typeof VolumeBackupsStateSchema>
\ No newline at end of file
diff --git a/packages/core/src/generated/zod/volume-backups-status-schema.ts b/packages/core/src/generated/zod/volume-backups-status-schema.ts
new file mode 100644
index 0000000000..c1c9d8c061
--- /dev/null
+++ b/packages/core/src/generated/zod/volume-backups-status-schema.ts
@@ -0,0 +1,19 @@
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+import * as z from "zod";
+import { VolumeBackupsStateSchema } from "./volume-backups-state-schema.js";
+
+/**
+ * @description Whether a container\'s snapshot schedule is in place.
+ */
+export const VolumeBackupsStatusSchema = z.object({
+    "message": z.string().describe("What is missing when the state is `setupRequired`").nullish(),
+get "state"(){
+                return VolumeBackupsStateSchema.describe("State of a container's snapshot schedule.")
+              }
+    }).describe("Whether a container's snapshot schedule is in place.")
+
+export type VolumeBackupsStatus = z.infer<typeof VolumeBackupsStatusSchema>
\ No newline at end of file
diff --git a/packages/core/src/generated/zod/volume-output-schema.ts b/packages/core/src/generated/zod/volume-output-schema.ts
new file mode 100644
index 0000000000..7389ea2ee2
--- /dev/null
+++ b/packages/core/src/generated/zod/volume-output-schema.ts
@@ -0,0 +1,23 @@
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+import * as z from "zod";
+import { VolumeRestoreOutputSchema } from "./volume-restore-output-schema.js";
+
+/**
+ * @description A replica\'s persistent volume and its latest completed snapshot.
+ */
+export const VolumeOutputSchema = z.object({
+    get "lastRestore"(){
+                return z.union([VolumeRestoreOutputSchema, z.null()]).optional()
+              },
+"lastSnapshotAt": z.string().describe("When the latest completed snapshot was started (RFC 3339)").nullish(),
+"lastSnapshotId": z.string().describe("Cloud ID of the latest completed snapshot, if any").nullish(),
+"ordinal": z.int().min(0).describe("Replica ordinal the volume belongs to"),
+"volumeId": z.string().describe("Cloud ID of the volume (EBS volume ID, Persistent Disk name, or Managed Disk ID)"),
+"zone": z.string().describe("Zone the volume lives in")
+    }).describe("A replica's persistent volume and its latest completed snapshot.")
+
+export type VolumeOutput = z.infer<typeof VolumeOutputSchema>
\ No newline at end of file
diff --git a/packages/core/src/generated/zod/volume-restore-output-schema.ts b/packages/core/src/generated/zod/volume-restore-output-schema.ts
new file mode 100644
index 0000000000..86822c3d00
--- /dev/null
+++ b/packages/core/src/generated/zod/volume-restore-output-schema.ts
@@ -0,0 +1,18 @@
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+import * as z from "zod";
+
+/**
+ * @description A completed volume restore.
+ */
+export const VolumeRestoreOutputSchema = z.object({
+    "completedAt": z.string().describe("When the restored volume was put in place (RFC 3339)"),
+"replacedVolumeSnapshotId": z.string().describe("Snapshot of the replaced volume, taken just before it was deleted"),
+"requestId": z.string().describe("ID of the restore request"),
+"snapshotId": z.string().describe("Snapshot the volume was restored from")
+    }).describe("A completed volume restore.")
+
+export type VolumeRestoreOutput = z.infer<typeof VolumeRestoreOutputSchema>
\ No newline at end of file